Privacy Policy

1. Who This Policy Covers

Ittisalo acts in two roles:

• As a data controller for account and billing information relating to our Tenants (the businesses that sign up for Ittisalo).
• As a data processor for the conversation and customer data that Tenants collect from their own End Users through connected WhatsApp, Instagram, and Messenger channels. Tenants remain the data controller for that End User data, and are responsible for having a lawful basis to collect and process it, including maintaining their own customer-facing privacy notice.

If you are an End User messaging a business that uses Ittisalo, please also refer to that business's own privacy policy, as they control how your information is used.

2. Information We Collect

3. How We Use Information

We use collected information to:

• Provide, operate, and maintain the Service, including AI-generated responses to End User messages.
• Create and manage Tenant accounts and process billing.
• Route, store, and retrieve conversation history to maintain context across messages.
• Generate embeddings and perform semantic search over a Tenant's knowledge base to power accurate AI responses.
• Detect, prevent, and investigate fraud, abuse, or security incidents (including duplicate-message and fraud-signal detection across Tenants where applicable).
• Send Tenants service-related communications (billing notices, product updates, support responses).
• Improve and develop the Service, including monitoring performance and reliability.
• Comply with legal obligations.

4. AI Processing and Third-Party Subprocessors

To generate automated responses, Ittisalo sends relevant conversation content to third-party AI providers (currently OpenAI) for processing. These providers process the data under their own data processing terms and do not use API-submitted data to train their models, consistent with their business/API data usage policies at the time of use. We recommend Tenants review the current policies of any AI provider we use, as these may change.

We use the following categories of subprocessors to operate the Service:

A current list of subprocessors is available on request.

5. Data Storage, Multi-Tenancy, and Security

• Each Tenant's data is logically isolated using row-level security and tenant-scoped access controls so that one Tenant cannot access another Tenant's conversations, contacts, or knowledge base.
• API keys, access tokens, and other credentials are encrypted at rest.
• We apply reasonable technical and organizational measures to protect data against unauthorized access, alteration, disclosure, or destruction. No system is completely secure, and we cannot guarantee absolute security.
• Data is hosted with providers that may store data outside your country of residence. By using the Service, you consent to this transfer.

6. Data Retention

• Tenant account data is retained for as long as the account is active, and for a reasonable period afterward to comply with legal, accounting, or billing obligations.
• Conversation datais retained for as long as needed to provide the Service (e.g., to maintain conversation context) and per each Tenant's own configured retention settings, where available.
• Tenants may request deletion of their account and associated data, subject to legal retention requirements. End Users seeking deletion of their data should contact the business (Tenant) they messaged directly, who may in turn instruct us to delete that data.

7. Your Rights

Depending on your location, you may have rights to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data.
• Object to or restrict certain processing.
• Request a copy of your data in a portable format.
• Withdraw consent where processing is based on consent.

To exercise these rights, contact us at Ittisaloai@gmail.com. If you are an End User of a Tenant's business, we may need to direct your request to that Tenant, as they control the underlying customer relationship.

8. Cookies

Our website and dashboard use cookies and similar technologies to keep you logged in, remember preferences, and understand usage patterns. You can control cookies through your browser settings; disabling some cookies may affect functionality.

9. Children's Privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us so we can remove it.

10. International Data Transfers

Ittisalo may process and store data in countries other than your own, including Pakistan and countries where our infrastructure providers operate. We take steps to ensure appropriate safeguards are in place for such transfers where required by law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a revised "Last updated" date, and where changes are material, we will provide additional notice (e.g., email or in-app notice).