Legal
Privacy Policy
Last updated
Who we are#
Officely AI LLC, a Delaware limited liability company, runs Officely, a platform businesses use to build chatbots and AI flows for WhatsApp, websites, Zendesk and Intercom. This policy explains how we handle personal data. Contact us at privacy@officely.ai.
We handle personal data in two different roles:
| Data | Our role | Whose privacy notice applies |
|---|---|---|
| Your account, billing, support and website data | Controller: we decide how it's used | This policy |
| Data about the people our customers' bots talk to (end users) | Processor: we handle it only on our customer's instructions | The customer's own privacy notice, plus our Data Processing Addendum |
If you chatted with a business's bot on WhatsApp, a website or a help desk, that business controls your data. Please contact the business to use your privacy rights. If you contact us, we'll pass your request on to them.
What we collect#
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Name, business name, email, WhatsApp phone number, profile image, role | You, or Google when you sign in with Google |
| Billing | Plan, invoices, billing address, last 4 digits and expiry of your card | You and our payment processors (Stripe, PayPal). We never see your full card number |
| Workspace content | Chatbots, AI flows, prompts, settings, knowledge files you upload, website pages you ask us to read | You |
| Channel connections | WhatsApp business account and phone number IDs, connection tokens, Zendesk and Intercom app details | You, Meta and the services you connect |
| Usage and device | Log-in times, pages and features used, IP address, browser and device type, errors | Collected automatically when you use Officely |
| Support and communications | Messages to our support team, survey answers, call bookings | You |
| Website and marketing | Pages visited, how you found us, newsletter sign-ups, cookie choices | Collected automatically and from you |
End-user data (the phone numbers, names, profile images, messages and answers of the people our customers' bots talk to) is processed for our customers as described in the DPA, not under this policy.
Why we use it#
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Create and run your account, and provide the service | Account, workspace content, channel connections | Performing our contract with you |
| Bill you and keep tax records | Billing, account | Contract; legal obligation |
| Keep the service secure, prevent fraud and abuse, enforce our terms | Usage and device, account | Legitimate interests: protecting our customers, their end users and Officely |
| Answer support requests | Support, account | Contract; legitimate interests |
| Improve and fix the service, using aggregated and de-identified statistics | Usage and device | Legitimate interests: making Officely better |
| Send service and security notices | Account | Contract; legal obligation |
| Send product news and marketing | Account, website and marketing | Consent, or legitimate interests for existing customers, with an opt-out in every email |
| Comply with law and respond to lawful requests | Any, as required | Legal obligation |
We don't sell personal data, and we don't make decisions about you with legal or similarly significant effects based solely on automated processing.
How we use AI#
Officely's AI features send the text needed to answer a request (such as a customer's message, the flow's instructions and relevant knowledge snippets) to AI model providers, which return a reply. They process it on our behalf under contracts that limit them to providing the service.
- No training on your data. We don't use your workspace content, or your end users' messages, to train our own or third-party general AI models. Our providers are contractually barred from doing so. We don't use data received through WhatsApp to train or improve AI models.
- Knowledge search. Files and web pages you add to a knowledge base are split into passages and stored as search vectors, so your flows can find relevant answers. They're kept separate for each customer and deleted when you remove them.
- AI disclosure. Conversations run by AI flows show that the end user is talking to AI. This follows the EU AI Act and Israel's Privacy Protection Authority guidance.
- Our own use of AI. We may use AI tools to help answer support requests and analyse aggregated product usage. Personal data in those tools is handled under this policy.
Who we share it with#
We share personal data only with service providers that help us run Officely, under contracts that require them to protect it and use it only for us. The full list of providers that process end-user data, with their locations, is in our sub-processor list.
| Service | Provider | Location |
|---|---|---|
| Hosting, databases and file storage | Amazon Web Services | Ireland (EU) |
| Conversation database | MongoDB Atlas | To confirm |
| Knowledge search | Pinecone | To confirm |
| AI models | OpenAI, Anthropic, Google, and other model providers listed in the sub-processor list | United States and EU |
| AI routing | Name to be added to the sub-processor list | To confirm |
| WhatsApp messaging | Meta Platforms Ireland (official API); Green API, only for customers who connect a number by QR code | Ireland; Green API to confirm |
| Payments | Stripe, PayPal | United States and EU |
| Sign-in | United States | |
| Support chat | Intercom | United States |
| Internal alerts and automations | Make | EU |
We also share data:
- with the services you choose to connect, such as Zendesk or Intercom, on your instructions;
- with Meta when its platform terms require it for WhatsApp connections;
- when the law requires it, or to protect the rights and safety of our users, the public or Officely;
- with a buyer or successor if Officely is involved in a merger or sale, under this policy.
Where data is stored and transferred#
Officely is a US company. Our main infrastructure runs in Amazon Web Services' Ireland region (EU), so most personal data is stored in the EU.
Some providers, including AI model providers, process data in the United States. For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses with additional safeguards. Transfers out of Israel follow Israel's Privacy Protection (Transfer of Data to Databases Abroad) Regulations. You can ask us for a copy of the safeguards we use.
How long we keep it#
| Data | How long |
|---|---|
| Account and workspace content | While your account is open, plus 30 days to let you export it, then deleted within 90 days |
| Billing records and invoices | 7 years, as Israeli tax law requires |
| Support conversations | 3 years after the request closes |
| Security and system logs | Up to 90 days, longer only while investigating an incident |
| Backups | Overwritten on a rolling cycle of up to 35 days |
| Marketing preferences | Until you unsubscribe, then kept only as a do-not-contact record |
| End-user data in customer bots | As our customer sets in Officely and the DPA describes |
Security#
We protect data with encryption in transit, access controls and multi-factor authentication for our staff, network isolation of our databases, activity logging, and regular reviews. No system is perfectly secure. If a breach affects your personal data, we'll tell you and the relevant authorities as the law requires.
Your rights#
Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict how we use it, and withdraw consent at any time. Email privacy@officely.ai and we'll answer within 30 days. We may need to confirm your identity first.
- EU and UK: you can also complain to your local data protection authority.
- Israel: you have rights to review and correct your information under the Privacy Protection Law, and you can complain to the Privacy Protection Authority.
- California: you have the rights to know, delete, correct and limit use of sensitive information, and not to be discriminated against for using them. We don't sell or share personal data for cross-context behavioural advertising, and we honour Global Privacy Control signals.
Cookies#
We use essential cookies to keep you signed in and secure. With your consent, we also use analytics cookies to understand how our website is used. You can change your choice at any time in the cookie settings.
Children#
Officely is a business service and isn't directed at anyone under 18. We don't knowingly collect children's data.
Changes#
We'll update the date at the top when this policy changes, and tell you in advance by email or in the product about material changes.
Contact#
Officely AI LLC · privacy@officely.ai
See also: Terms of Use