Privacy policy

1. Who we are and when this policy applies

Zupright provides business software, AI assistants and communication services. This policy explains how we handle personal information through our website, AI-assisted web chat, connected WhatsApp services and related customer support activities.

When you contact Zupright or use our website, we determine how information is used to manage that relationship and operate our services. When a business uses Zupright to serve its customers, we generally process that business’s customer information on its behalf and under our agreement with it. That business determines its purposes and should provide its own privacy notice. Contact the business operating the chatbot or WhatsApp number about how it uses your information.

2. Information we process

Depending on the features used, we may process your name, telephone number, email address, business details, enquiries, messages, AI-generated responses, feedback and other information you choose to submit. A business may also provide customer records, contact lists, documents and website content for its enabled services or chatbot knowledge base.

Connected WhatsApp services process business-account and phone-number identifiers, messages, contact information, campaign preferences and delivery records. When a business authorizes Zupright to connect its Meta assets, we also process the integration credentials and authorization information needed to operate that connection.

We may process technical information such as the website domain, browser and device information, network information, visitor and session identifiers, request identifiers, usage records and operational or security logs. Diagnostic records may contain relevant request and response content when diagnostic collection is enabled.

3. Why we use information

We use information to provide and maintain the services, answer enquiries, generate chatbot responses, search business-provided knowledge, maintain conversation context, record customer-authorized enquiries or leads, deliver messages, troubleshoot problems and protect against misuse. We also use information to manage our customer relationships and meet applicable legal obligations.

Businesses are responsible for having the necessary rights and permissions to provide information and send communications through Zupright. An enquiry or support conversation does not, by itself, authorize unrelated marketing. Marketing preferences and permissions should be handled separately from requests for support.

4. AI features and external providers

Some features use AI providers, including OpenAI when configured, to generate responses, interpret requests or create searchable representations of documents. Relevant messages, selected conversation context, instructions and knowledge excerpts may be transmitted to the configured provider. Searchable representations, sometimes called embeddings, help find relevant information in a business’s knowledge base.

AI responses may be inaccurate or incomplete. Avoid submitting passwords, payment credentials or sensitive information that is unnecessary for your enquiry. Consult the business operating the assistant when a response requires confirmation or human assistance.

Provider processing, data use and retention are governed by the applicable service arrangements and provider data controls. Disabling response storage does not necessarily eliminate provider security or abuse-monitoring retention. Contact us if you need information about the processing arrangements that apply to your organization. This policy does not grant permission to use customer content for unrelated model training.

5. Who receives information

Information may be available to the business operating the chatbot or communication channel and its authorized personnel. We use service providers for hosting, storage, AI processing, communications and operational support, including AWS where configured. Connected applications receive information when a business enables the relevant integration.

WhatsApp communication involves Meta’s services and is also subject to Meta’s applicable privacy practices. Zupright’s handling of information after it reaches the business integration is described in this policy and the relevant customer agreement.

We may disclose information where necessary to meet legal obligations, respond to valid legal requests, address security incidents or protect legitimate rights. We may also disclose information as part of a business transaction, subject to applicable confidentiality and legal requirements.

6. Cookies and browser storage

Our chatbot uses browser local storage to remember visitor, session and conversation identifiers so a conversation can continue across visits. These identifiers can remain until browser storage is cleared or replaced. Clearing them may reset conversation continuity; it does not delete records already held by the service.

Other parts of the platform may use cookies or browser storage for sign-in, security, preferences and service functionality. You can manage storage through your browser settings, although disabling it may affect features. Where optional tracking is used and consent is required, the relevant notice and choices should be provided before that tracking occurs.

7. Retention and deletion

Retention depends on the service purpose, customer instructions, contractual requirements and applicable legal or security needs. Conversations, contacts, uploaded documents, diagnostic records and backups may have different retention arrangements. Information is not necessarily deleted automatically when a conversation ends or a business disconnects a WhatsApp number.

You may request access, correction or deletion using the contact details below. We may need to verify your identity and authority, identify the relevant records and coordinate with the business responsible for them. Some information may need to be retained for legal, security or dispute-resolution purposes. Backup and service-provider copies may follow separate retention arrangements.

8. Security and international processing

We use technical and organizational measures designed to protect information, including access controls, tenant-scoped processing and protection of integration credentials. No method of transmission or storage can guarantee absolute security.

Information may be processed outside your country through hosting, AI or communication providers. The locations and safeguards that apply depend on the enabled services, customer agreement, provider arrangements and applicable law. Contact us with questions about the arrangements for your organization.

9. Your choices and privacy requests

Depending on applicable law and the circumstances, you may have rights to access, correct, delete or receive a copy of personal information, object to or restrict processing, or withdraw consent where processing depends on consent. Withdrawal does not affect processing that already took place lawfully. You may also have the right to contact the relevant data protection authority.

If a business collected your information through its chatbot or WhatsApp number, contact that business first. We can help route a request to the appropriate business when necessary. For information processed by Zupright directly, contact us using the details below. Include the relevant business or website and enough information to identify your request; do not send passwords or access tokens.

Our services are intended for business use and are not directed at children. Contact us if you believe a child has provided personal information that should be reviewed or removed.

10. Changes to this policy

We may update this policy as our services and processing practices change. We will publish the revised version and its last-updated date on this page and provide additional notice where required.