Privacy Policy

1. Who this policy is about

Two groups of people use or meet our service:

• Business customers: the businesses that create a PatchPoint workspace, and the team members they invite. For their account information, we decide how it is used.
• People who message a business: when you write to a business that uses PatchPoint on WhatsApp or by text message, that business decides how your messages are used. We process them on the business's behalf and only to provide our service to it.

If you messaged a business, its own privacy policy also applies. Questions about your conversation are best sent to that business first. We will help it answer them.

2. Information we collect

• Account information: your name, email address, password (stored only as a one-way hash), and, if you add them, a phone number, a profile picture and two-step verification settings.
• Workspace information: the business name and logo, time zone, team members and their roles, assistant settings, knowledge base articles, business hours and other settings.
• Messages: the text, images, files, audio and video, and delivery status of messages sent and received through numbers connected to a workspace, and when they were sent.
• Contact details of people who message a business or whom it adds: phone number, WhatsApp ID, the profile name they chose on WhatsApp, an email address when they give one for a booking confirmation or the business adds it, and what the business's team records about them: a name, a birthday, tags, groups and notes, with each note's earlier versions.
• Connected accounts: identifiers and access tokens for WhatsApp Business accounts, and keys a business provides for add-ons or its own AI provider. These are stored encrypted.
• Billing information: your business name, billing address and tax registration numbers, plan, invoices, payment status, and a prepaid balance with its history. Card payments are handled by our payment processor; we never receive full card numbers.
• Phone numbers and usage: numbers a workspace buys, and the count and cost of messages sent and received.
• Booking information, when a business uses PatchPoint Booking: its locations and services, records of its staff (name, contact details, shifts, time clock entries and leave), appointments, and visit notes its team writes about clients.
• Documents a business attaches to its clients, its staff and leave requests, such as consent forms, contracts and doctor’s notes.
• Calls: who called whom and when, how long a call lasted and who answered it, voicemail messages and, when a business switches recording on, recordings of its calls, with their transcripts.
• Technical information: IP address, browser type, a device cookie, and logs of sign-ins and errors.

3. How we use information

• To run the service: receive, store, show and send messages, route them to the right workspace, and keep the inbox in sync across a team.
• To run the AI assistant, when a business switches it on (see below).
• To check images customers send for unsafe content before staff see them.
• To ring a business's team in the browser when a customer calls, place the calls its team makes, take voicemail and, when the business switches it on, record calls; recordings and voicemail are transcribed.
• To bill for plans, prepaid usage and phone numbers.
• To run PatchPoint Booking for a business that uses it: its diary, rosters, timecards and leave, and the booking updates it chooses to send to its own systems.
• To send a business's customers the booking confirmations, reminders and cancellations the business switches on, by email or text message, in the business's name. Replies go to the business.
• To keep accounts and the service secure: sign-in protection, two-step verification, and preventing abuse, including making sure each business gets one free trial.
• To send service email: account verification, password resets, billing notices and low balance warnings.
• To answer support requests and meet legal obligations.

We do not sell personal information. We do not use it for advertising, and we do not build marketing profiles of people who message a business.

4. The AI assistant

When a business switches its assistant on, the recent messages of a conversation, the business's instructions and knowledge base, and images in the conversation are sent to an AI provider so it can write a reply. The provider returns the reply; we send it and keep it in the conversation.

We do not use messages to train AI models. On our keys, our providers do not train on this content under their business terms, and where a provider offers it, we ask it not to store the content. A business that uses its own AI key does so under its own agreement with that provider.

The assistant hands a conversation to the business's team when it cannot help or when a customer asks for a person.

5. WhatsApp and Meta data

PatchPoint connects to WhatsApp through Meta's WhatsApp Business Platform. When a business connects its WhatsApp account, Meta shares with us the account and phone number details, an access token, and the messages its customers send and receive.

We use this information only to provide our service to that business: to show and answer its conversations. We do not sell it, use it for advertising, or combine it with data from other businesses. We follow the Meta Platform Terms and the WhatsApp Business policies.

A business can stop sharing at any time by removing our app from its Meta business settings. To have the data deleted, see Deleting your data, below.

6. Who we share information with

We share information only with service providers that help us run the service, under contracts that limit their use of it to that purpose:

• Meta (WhatsApp Business Platform): sending and receiving WhatsApp messages.
• Telephony providers: phone numbers, text messages, phone calls, voicemail and call recordings.
• Speech-to-text providers: transcribing voicemail and recorded calls.
• AI providers: AI replies and image checks, when the assistant or image checks are on.
• Payment processors: payments, invoices, and the calculation and reporting of sales tax.
• Cloud hosting and storage providers: running the service and storing its data, including images, files and documents.
• Network providers: delivering and protecting our website.
• Calendar services: only when a business connects its calendar for bookings.
• A business's own systems: the booking updates it asks PatchPoint Booking to send them.
• Email providers: sending service email.

We may also disclose information when the law requires it, to protect the rights or safety of people or the service, or as part of a sale or merger of our business, in which case this policy continues to apply.

7. Where information is stored

Our servers and storage are in Canada and the United States. Some service providers, such as Meta and the AI providers, may process information in other countries. When information leaves your country, we rely on contracts and the providers' safeguards to protect it, and it may be subject to the laws of those countries.

8. How long we keep information

• Workspace data, messages and contacts: while the workspace is active. A business can delete customer images and files from the inbox at any time.
• Documents a business attaches: until the business deletes them, or the workspace is deleted. They are stored with our storage provider.
• Call recordings, voicemail and their transcripts: until the business deletes them, or the workspace is deleted. They are stored with our storage provider.
• After an account or workspace is closed, or a deletion request is confirmed: deleted within 30 days.
• Billing records: as long as tax and accounting law requires, generally six years in Canada.
• IP addresses used for abuse prevention: up to 90 days.
• The workspace audit log (who changed a setting, the team, a number or a contact, and when, shown to owners and admins): 2 years.
• A text or event from our messaging provider that we could not process: up to 7 days, so it can still be delivered, then deleted.
• The record of a booking update PatchPoint Booking sent to a business's own system: 30 days.
• To make sure each business gets one free trial, we keep a keyed, one-way hash of identifiers such as an email address or phone number. The original value cannot be read back from it.

9. Security

All traffic to the service is encrypted in transit. Access tokens, keys and two-step secrets are encrypted at rest. Each workspace's data is kept apart from every other workspace's, team members see only what their role allows, and accounts can use two-step verification. No system is perfectly secure; we will tell affected customers and the authorities of a breach as the law requires.

Our support staff can sign in to your workspace as an administrator or agent to help you; every such session and what is done in it is recorded in your workspace's audit log.

10. Your choices and rights

You can ask to see, correct or delete the personal information we hold about you, or withdraw your consent, by writing to [email protected]. Account holders can change most of their details in the app, under Account. We answer within 30 days.

If you messaged a business, ask that business first; we will act on its instructions. If you cannot reach it, write to us with your phone number and the business's name.

On text messages, reply STOP to stop messages from that number. To stop booking emails or texts, ask the business. On WhatsApp, you can block the business at any time.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the privacy authority where you live.

11. Deleting your data

We confirm every deletion request and complete it within 30 days.

• If your business uses PatchPoint: email [email protected] from the address on your account, with the subject "Delete my workspace" and your workspace's name. Only an owner can ask for a workspace to be deleted. We delete its messages, contacts, images, files, settings, team and stored connections, and your sign-in account unless you belong to another workspace. To delete only your own account, say so in the email.
• To stop PatchPoint receiving your WhatsApp messages: in Meta Business Suite, open Settings, Business integrations (or Apps), and remove PatchPoint. Then ask us to delete the data already received, as above.
• If you messaged a business that uses PatchPoint: ask that business to delete your conversation. If you cannot reach it, email [email protected] with your phone number and the business's name. We pass the request on and, unless the business must keep the messages by law, delete them.

We keep billing records as long as tax law requires, and the one-way hash described above. The same steps are on their own page at /data-deletion.

12. Cookies and browser storage

We use a session cookie to keep you signed in, and a device cookie to protect sign-in and free trials from abuse. A language cookie remembers the language you chose. Your browser also stores a few preferences, such as light or dark mode. We use no advertising or analytics cookies.

13. Children

PatchPoint is a service for businesses and is not meant for anyone under 16. We do not knowingly collect information from children.

14. Changes to this policy

When we change this policy, we post the new version here with a new date. If a change is significant, we also tell workspace owners by email or in the app before it takes effect.

15. Contact us

Tsiana Inc., Ontario, Canada. For privacy questions and requests, write to our data protection officer at [email protected].