Privacy Policy

1. How We Collect Personal Data

What personal data we collect depends largely on the interaction that takes place between you and iSales AI. Most of these interactions can be categorized as follows:

• When you use the iSales AI Service or interact with an entity that uses an iSales AI Service:When you use our Service (e.g., configure chatbots via our native Telegram bot interface, integrate with messaging platforms like Telegram, WhatsApp, Facebook, Instagram), we store the content you provide, including information related to you as a customer or an authorized end user of the Service. We gather this information directly from you when you enter it, or from integrations that you link to the Service (e.g., your connected messaging platform accounts). When you ask us to sign a DPA or other documents, we also receive data about you and your representatives. In some cases, we may receive information from third parties, e.g., from a payment service provider regarding the success of your Credit purchase.
• When you send us emails or message us:When we receive emails or messages from you (e.g., through support channels or the native Telegram bot), we may store the content of such communications, attachments, as well as your contact details.
• When you submit forms on the Site or participate in our events:When you complete forms on the Site (e.g., contact us, subscription, demo request, event registration), we collect your contact details and any information you provide in the form. If we arrange joint events with our partners, we may receive information from them.
• When you use the Site:When you use our Site, we may collect certain information automatically, as described in more detail below (e.g., through cookies and similar technologies), which may, alone or in combination with other information, constitute personal data. Please see our Cookie Policy for more details.
• When you join our communities:If you join our communities on platforms like Facebook or other social media groups, we may see data in your public profile and process comments you post in our groups. However, we typically do not systematically gather this information or copy it into our systems beyond what is necessary for community management or responding to inquiries.

2. What Types of Personal Data We Process

We collect and process the following categories of personal data:

• Customer Account Details:To create or update your Account and provide the Service, we collect from you and potentially from third-party integrations (e.g., Telegram, WhatsApp, Facebook, Instagram) information about you as a customer or authorized end user. This includes your user ID, name, email address, phone number, Telegram account details (if linked for the Platform Interface), linked messaging platform pages and accounts, chatbot configurations, prompts, training data snippets, knowledge bases you provide, products/services in use, location (if provided), and other settings or preferences.
• Financial Information:To process your payments for Credits or other Service subscriptions, we (or our third-party payment processors) may collect your credit card details (e.g., last four digits of the card number, expiration date), bank account details, billing address, and other payment information.
• Contact Details and Business Data:We receive information about our customers, potential customers, and business partners for cooperation and communication purposes. This includes full name, title, company name, email address, phone number, or other contact details as may be necessary.
• Requests, Messages, and Submitted Forms Details:We receive and process your messages, support requests, emails, and information you share with us via online forms, surveys, or social media accounts. This includes the content of such communications as well as your contact details.
• Usage Data, Logs, and Other Technical Data:When you interact with the Service (including the native Telegram bot interface) or our Site, metadata and log files may be collected automatically. Log data may include your Internet Protocol (IP) address, browser type and settings, device information (type, operating system, device settings, device identifiers), the date and time you used the Service or Site, information about browser configuration and plugins, language preferences, the pages or features which you browsed, time spent on those pages or features, the frequency of use, links clicked on, and other diagnostic data.
• Email Performance Data:To track engagement and performance metrics of our newsletters and other email communications, we may use technologies like 'clear images' (gifs) or tracking pixels. Much of this data is aggregated. You can typically disable this tracking by turning off images in your email client.
• Website Cookies and Similar Technologies:We use cookie technology and similar tracking technologies on our Site to collect information about your browsing activities. For more details, please see our Cookie Policy.
• Customer Content (Data Processed on Behalf of Customers):As you use our Service, you may input, upload, or cause the Service to process personal data you have collected from your end-users, customers, prospective customers, social media contacts, messaging platform contacts (collectively "Conversation Participants"), or other individuals. This "Customer Content" includes chatbot configurations, prompts, training data, knowledge bases, and the content of conversations between your chatbots and Conversation Participants on platforms like Telegram, WhatsApp, Facebook, and Instagram. We process this data strictly on your behalf as our customer and in accordance with your instructions and our DPA. We have no direct relationship with your Conversation Participants regarding this data, and you, as the data controller, are responsible for ensuring you have the appropriate permissions and legal basis for us to collect and process information about those individuals and that you have informed them about such processing. For detailed information on how we process Customer Content, please see our Data Processing Addendum.
• Customer's Conversation Participants' Data (as Controller):In limited circumstances, we may process data about your Conversation Participants as a controller, for example, for aggregated analytics to improve our services, for security and fraud prevention, or to comply with legal obligations. This data may include identifiers, conversation metadata, and aggregated interaction patterns.

We ask that you do not send or disclose to us any sensitive personal data (e.g., depending on your applicable data protection law, this may include social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, data regarding health or sexual life, criminal background, or trade union membership) on or through the Service or otherwise, unless specifically requested by us or necessary for the provision of the Services and with appropriate legal safeguards in place.

3. For Which Purposes We Use Personal Data

We collect and process your personal data (as a controller) for the following purposes:

• To Operate and Provide the Service:We use your data to enter into and perform our agreement with you as a customer, operate, maintain, and administer your Account in the Service (including managing chatbot configurations via the native Telegram bot interface), and to communicate with you regarding your Account (e.g., sending announcements, technical notices, updates, security alerts, and support and administrative messages). We also use your data to respond to Service-related requests, questions, and feedback, and to perform our billing obligations (e.g., processing payments for Credits).
• To Provide the Service (as a Processor):We process Customer Content, including personal data of Conversation Participants, on your behalf as a customer to enable the functionality of the AI chatbots on integrated messaging platforms. This is governed by our DPA with you.
• To Communicate with You and Inform You About the Service:If you request information from us, register for the Service, complete a form or provide feedback on our Site, or participate in our surveys, promotions, or events, we may send you iSales AI-related marketing communications if permitted by law and your communication preferences. In all such communications, we will provide you with the ability to opt-out. We may also use personal data collected about you to personalize your experience and to display targeted advertisements or campaigns on social media or other platforms, subject to your consent where required.
• To Conduct Events and Communicate with You:We use your personal data, which you provided when registering for an event, to send you reminders about the event, communications related to the event, and information about iSales AI-related services. We may also ask for your feedback. In such communications, we will always provide the possibility to opt-out.
• To Improve Our Services:We may use aggregated and anonymized data derived from your use of the Services (including interactions with AI models and Customer Content, subject to the terms of our DPA and your instructions) for research and development, to analyze trends, to improve the functionality, intelligence, and security of our AI models and the overall Service, and to develop new features and services.
• To Comply with Law:We use your personal data as necessary or appropriate to comply with applicable laws, including sanctions requirements, accounting and tax obligations, lawful requests, legal processes, or audits, and to respond to subpoenas or legally binding requests from government authorities. Before disclosing any information to an authority upon its request, we will assess the validity of such a request.
• To Negotiate, Enter Into, and Perform Agreements:We collect and process information about our counterparties (e.g., vendors, partners) and their representatives to negotiate and enter into legally valid agreements and to cooperate with them.
• For Compliance, Fraud Prevention, and Safety:We use your personal data as we believe necessary or appropriate to (a) enforce the terms and conditions that govern the Service (our Terms of Service); (b) protect our rights, privacy, safety, or property, and/or that of you or others; and (c) protect, investigate, and deter against fraudulent, harmful, unauthorized, unethical, or illegal activity.

4. How We Share Personal Data

We do not sell your personal data to third parties for their commercial or advertising purposes. We share your personal data only as described in this Privacy Policy, with your consent, or as required or permitted by applicable law.

We may disclose personal data to third parties under the following circumstances:

• Service Providers:We employ third-party companies and individuals to help us with the performance of certain activities and to provide aspects of our Service. These include payment service providers (for Credit purchases), cloud hosting providers, Large Language Model (LLM) providers (whose AI models may power aspects of our Service), CRM software providers, email service providers, analytics providers, and security service providers. We maintain a list of our key sub-processors at www.isales.ai/legal/service-providers (or your specific domain). These third parties are permitted to use your personal data only to perform tasks on our behalf and are obligated not to disclose or use it for any other purpose, in accordance with the terms of our agreements with them.
• Professional Advisors:We may disclose your personal data to professional advisors, such as lawyers, bankers, auditors, and insurers, where necessary in the course of the professional services that they render to us.
• Third-Party Platforms and Integrations:For the provision of the Service, we necessarily exchange data with messaging platforms (Telegram, WhatsApp, Facebook, Instagram) that you integrate with our Service. This sharing is based on your instruction to enable the chatbot functionality on these platforms. Your use of these platforms is subject to their respective privacy policies and terms.
• Business Transfers:As we develop our business, we might sell or buy businesses or assets. In the event of a corporate sale, merger, reorganization, dissolution, bankruptcy, or similar event, personal data may be part of the transferred assets. You acknowledge and agree that any successor to or acquirer of iSales AI (or its assets) will continue to have the right to use your personal data and other information in accordance with the terms of this Privacy Policy, unless otherwise agreed or required by law.
• Compliance with Laws and Law Enforcement:iSales AI may disclose information about you to government or law enforcement officials or private parties as required by law, and disclose and use such information as we believe necessary or appropriate to (a) comply with applicable laws and lawful requests and legal processes, such as to respond to subpoenas or requests from government authorities; (b) enforce the terms and conditions that govern the Service; (c) protect our rights, privacy, safety, or property, and/or that of you or others; and (d) protect, investigate, and deter against fraudulent, harmful, unauthorized, unethical, or illegal activity.
• Corporate Affiliates:We may share personal data with our corporate affiliates (entities under common ownership or control with iSales AI) for purposes consistent with this Privacy Policy, such as providing shared services or for internal administrative purposes. A list of our corporate affiliates, if any, can be found at www.isales.ai/legal/service-providers (or your specific domain).

5. Your Data Protection Rights & Choices

Depending on your location and applicable data protection laws, you may have the following rights regarding your personal data that iSales AI processes as a controller:

• Right to Access:You may have the right to request confirmation of whether we process your personal data and to access a copy of such personal data.
• Right to Rectification:You may have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
• Right to Erasure (Deletion):You may have the right to request the deletion of your personal data under certain circumstances (e.g., if the data is no longer necessary for the purposes for which it was collected). You can find more details on how to request account deletion by contacting us.
• Right to Information about Sharing:You may have the right to request information about third parties with whom your personal data has been shared.
• Right to Information about Consent:You may have the right to request information about the possibility of not providing consent and the consequences of such refusal.
• Rights for Individuals in the EEA, UK, Brazil, or Switzerland:
  • Right to Object to Processing: You can object to the processing of your personal data where we rely on legitimate interests as our legal basis.
  • Right to Restrict Processing: You can ask us to restrict the processing of your personal data in certain situations.
  • Right to Data Portability: You can request the portability of your personal data that you provided to us and that is processed by automated means based on your consent or for the performance of a contract with you (where technically feasible).
  • Right to Withdraw Consent: If we have collected and processed your personal data with your consent, you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the processing of your personal data conducted in reliance on other lawful processing grounds.
• Right to Lodge a Complaint:You have the right to lodge a complaint with a competent data protection authority about our collection and use of your personal data. Contact details for data protection authorities in the EEA are available here, in the UK here, and Brazil's ANPD service is available here.

To exercise any of these rights, please submit your request by emailing us at [email protected]. We will respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws. We may need to verify your identity before processing your request.

Access to Data Controlled by our Customers (Customer Content):iSales AI has no direct contractual relationship with the Conversation Participants whose personal data is processed by our customers using the Service. An individual who seeks access to, or who seeks to correct, amend, or delete personal data processed in the Service by one of our customers (the data controller) should direct their request to that customer directly. If a customer requests iSales AI to remove the data, we will respond to their request within a reasonable timeframe in accordance with our DPA.

6. For How Long We Retain Personal Data

We will retain your personal data (that we process as a controller) for as long as your Account is active or as needed to provide you with the Services, and for a reasonable period thereafter as necessary to comply with our legal and contractual obligations, resolve disputes, prevent abuse, and enforce our agreements.

For example, if you are located in Brazil, we may be required to store access logs for a 6-month period to meet the requirements of the Brazilian Internet Act (Law 12,965/2014).

When we no longer have an ongoing legitimate business need to process your personal data, we will either delete or anonymize it, or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible.

For data processed on behalf of our customers (Customer Content), we retain such data in accordance with the terms of our DPA and the customer's instructions.

7. International Data Transfers

Your personal data may be stored and processed in any country where we have facilities or in which we engage service providers, including the United States and other jurisdictions which may not have data protection laws equivalent to those in your country of residence.

iSales AI is committed to ensuring that your personal data is protected when transferred internationally. If we transfer your personal data from the European Economic Area (EEA), the UK, or Switzerland to countries outside of these regions that are not deemed to provide an adequate level of data protection, we will take appropriate safeguards to ensure that your personal data remains protected in accordance with applicable data protection laws. These safeguards may include implementing Standard Contractual Clauses (SCCs) as approved by the European Commission (or the UK Information Commissioner's Office, or the Swiss Federal Data Protection and Information Commissioner, as applicable), or relying on other valid data transfer mechanisms.

8. Children's Information

We believe it is important to provide added protection for children online. The Site and the Service are not intended for use by anyone under the age of 18 (or the age of legal majority in their jurisdiction if higher), nor does iSales AI knowingly collect or solicit personal data from anyone under such age.

If you are under 18 (or the applicable age of majority), you may not attempt to register for the Service or send any information about yourself to us, including your name, address, telephone number, or email address. In the event that we confirm that we have collected personal data from someone under the applicable age of majority without verification of parental consent, we will delete that information promptly. If you are a parent or legal guardian of a child under the applicable age of majority and believe that we might have any information from or about such a child, please contact us at [email protected]. We do not knowingly sell any Personal Data of our customers, including those aged between 13 and 18.

9. Automated Decision Making

If you are located or serve customers in the EEA, United Kingdom, Switzerland, or Brazil, you must not use the Service for automated individual decision-making, including profiling, that produces legal effects concerning individuals or similarly significantly affects them, unless such processing is permitted by applicable data protection law (e.g., with explicit consent, necessary for entering into or performance of a contract, or authorized by Union or Member State law). This includes, but is not limited to, using the Service for:

• Assessing financial information to determine eligibility for loans or credit.
• Screening resumes and applications based on predetermined criteria to decide which candidates progress in hiring or educational admissions.
• Evaluating applicants' data to determine insurance premiums or coverage eligibility.
• Assessing applications for government benefits using user-provided data.

You are responsible for ensuring your use of the Service complies with these restrictions and any other applicable laws regarding automated decision-making.

10. Security

Safeguarding Your Information:

We take reasonable and appropriate administrative, technical, and physical measures to protect personal data from loss, misuse, and unauthorized access, disclosure, alteration, and destruction, taking into account the risks involved in the processing and the nature of the personal data. Details of our security measures can be found in Annex 2 of our Data Processing Addendum.

Despite these efforts, no security system is impenetrable, and we cannot guarantee the absolute security of personal data during its transmission or its storage in our systems. Further, while we attempt to ensure the integrity and security of personal data, we cannot guarantee that our security measures will prevent third parties such as "hackers" from illegally obtaining access to personal data. We do not warrant or represent that personal data about you will be protected against loss, misuse, or alteration by third parties.

Payment Security:

If you make payments for Credits, your payment information is processed by our third-party payment processing vendor(s) who use security measures to protect your information both during the transaction and after it is complete, in compliance with Payment Card Industry Data Security Standard (PCI DSS).

Notice of Breach of Security:

If a security breach causes an unauthorized intrusion into our system that materially affects you or the personal data of your Conversation Participants for which you are the controller, then we will notify you (and relevant authorities where required by law) as soon as reasonably possible and later report the action we took in response, in accordance with applicable law and our contractual obligations.

If you have any questions about the security of your personal data, you may contact us by email at [email protected].

11. Legal Basis for Processing Your Personal Data (Brazil, EEA, UK Visitors/Customers Only)

If you are a person located in Brazil, the European Economic Area (EEA), or the UK, our legal basis for collecting and using the personal data described above (where we act as a controller) will depend on the personal data concerned and the specific context in which we collect it.

• Performance of a Contract:We process personal data to perform our contract with you for the use of the Service (Art. 6(1)(b) of the GDPR or UK GDPR; Art. 7(V) of LGPD). This includes creating and managing your Account, providing customer support, and processing payments.
• Legitimate Interests:We also process personal data based on our legitimate interests (Art. 6(1)(f) of the GDPR or UK GDPR; Art. 7(IX) of LGPD), provided that such interests are not overridden by your data protection interests or fundamental rights and freedoms. Our legitimate interests include:
  • Communicating with you and informing you about our Service, updates, and offers (where permitted by law).
  • Conducting events and webinars.
  • Improving our Service, including our AI models (typically using aggregated or anonymized data for this purpose).
  • Ensuring the security and integrity of our Service.
  • For compliance, fraud prevention, and safety purposes.
  • Enforcing our legal rights and agreements.
• Consent:We may process some types of personal data based on your consent (Art. 6(1)(a) of the GDPR or UK GDPR; Art. 7(I) of LGPD). This may include, for example, the use of certain non-essential cookies on our Site or sending you certain marketing communications. Where we rely on consent, you have the right to withdraw it at any time.
• Legal Obligation:We may process personal data to comply with a legal obligation (Art. 6(1)(c) of the GDPR or UK GDPR; Art. 7(II) of LGPD), such as tax and accounting requirements, or responding to lawful requests from authorities.

You are generally not obliged to provide your personal data to us. However, if we need personal data in order to enter into and perform a contract with you and you do not provide this data, we may not be able to perform the contract we have or are trying to enter into with you (e.g., to provide you with the Services).

If you have questions about or need further information concerning the legal basis on which we collect and use your personal data, please contact us by email at [email protected].

12. For California Residents

If you are a resident of California, this section provides additional details about the personal information we collect and your rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Your Rights:

1. Right to Know/Access:

   You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months, including:

   • The categories of personal information we collected about you.
   • The categories of sources for the personal information we collected about you.
   • Our business or commercial purpose for collecting or selling that personal information.
   • The categories of third parties with whom we share that personal information.
   • The specific pieces of personal information we collected about you.
   • If we sold or disclosed your personal information for a business purpose, two separate lists disclosing: sales, identifying the personal information categories that each category of recipient purchased; and disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
2. Right to Delete:You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions.
3. Right to Correct:You have the right to request that we correct inaccurate personal information that we maintain about you.
4. Right to Opt-Out of Sale/Sharing:iSales AI does not "sell" personal information in the traditional sense (i.e., for monetary gain). However, the CCPA/CPRA definition of "sale" and "sharing" (for cross-context behavioral advertising) is broad. If our use of certain third-party cookies or tracking technologies is deemed a "sale" or "sharing," you have the right to opt-out. You can manage your cookie preferences through our cookie preference center.
5. Right to Limit Use and Disclosure of Sensitive Personal Information:You have the right to direct us to limit our use of your sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer. (We ask that you not send us sensitive personal information unless necessary, as stated in Section 2).
6. Right to Non-Discrimination:We will not discriminate against you for exercising any of your CCPA/CPRA rights.

Exercising Your Rights:

To exercise the rights described above, please submit a verifiable consumer request to us by emailing [email protected] or through any "Privacy Request" or "Support" section on our Site if available.

Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf ("Authorized Agent"), may make a verifiable consumer request related to your personal information. We may require that you provide the Authorized Agent with written permission to do so and verify your own identity directly with us, unless the agent provides a power of attorney.

We will respond to verifiable consumer requests within 45 days of receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.

"Do Not Track":Some browsers offer a "Do Not Track" (DNT) signal. There is currently no universally accepted standard for how to respond to DNT signals. Therefore, we do not currently respond to DNT browser signals or mechanisms.

Shine the Light:California Civil Code Section 1798.83 permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please contact us at [email protected].

13. Changes to Our Privacy Policy

We may need to change this Privacy Policy from time to time to reflect legal, technical, or business developments. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Policy changes if and where this is required by applicable data protection laws.

You can see when this Privacy Policy was last updated by checking the "Last Updated" date displayed at the top of this Privacy Policy. The new Privacy Policy will apply to all current and past users of the Site and Service and will replace any prior notices that are inconsistent with it. We encourage you to review this Privacy Policy periodically to stay informed about our collection, use, and sharing of personal information.

14. How to Contact Us

If you require any more information or have any questions or concerns about our Privacy Policy or our data protection practices, please feel free to contact us by:

Email: [email protected]

Or via any official support channels provided through the Service or on our Site.