Privacy Policy

Data we process

Account data: name, email address, company name, password (stored hashed) and billing status.

Conversation data on behalf of customers: phone numbers, names and details that callers or chat users share, transcripts, summaries, appointments and, only if the customer switches it on, call recordings.

Technical data: IP addresses and logs needed for security and abuse prevention.

Purposes and legal bases

Providing the service and support (performance of the contract), billing and accounting (legal obligation), security and fraud prevention (legitimate interest). We do not sell data and do not use conversations to train AI models.

Sub-processors

Hetzner Online GmbH, Germany: hosting of the application and database.

OpenAI, L.L.C., United States: speech and language processing during conversations. Transfers are covered by the EU-US Data Privacy Framework and standard contractual clauses; data sent through the API is not used for training.

Telnyx LLC, United States and EU: phone numbers and call handling, only when the customer uses the phone channel.

Mollie B.V., the Netherlands: payments.

Google Ireland Ltd.: sending of emails.

Meta Platforms Ireland Ltd.: WhatsApp messages, only when the customer connects WhatsApp.

Connected calendars (Google Calendar and Microsoft Outlook)

A customer can connect a Google or Microsoft calendar to an assistant. We use that access for three things only: reading when the calendar is busy (start and end times, never titles, descriptions or attendees) so the assistant only offers free times; adding the appointments the assistant books to the calendar the customer chose; and removing those appointments when they are cancelled. We also read the list of calendars, so the customer can choose one, and the email address of the connected account, to show which account is connected.

Event details are never sent to AI providers; the assistant only receives the resulting free times. Calendar data is not used to train AI models, not used for advertising, and not sold or shared with anyone else. Access tokens are stored encrypted, and busy times are only kept in memory for at most one minute.

Nswerd's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The customer can disconnect the calendar in the dashboard at any time; we then delete the tokens, and for Google we also revoke them. Access can also be removed in the Google or Microsoft account settings. Appointments already added to the calendar stay there.

Retention

Conversation data is kept while the customer's account is active, unless the customer deletes it earlier. After an account ends, data is deleted within 30 days; server backups are overwritten within 7 days. Billing records are kept for 7 years as required by Dutch tax law.

Security

Data is encrypted in transit, stored in the EU, access is limited to what is needed, and secrets such as connected tokens are stored encrypted.

Your rights

You can ask for access, correction, deletion, restriction or a copy of your data, and object to processing, by emailing info@shipitdigital.nl. If you were a caller of one of our customers, contact that business first; we will help them. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Cookies

We only use functional cookies: a session cookie to keep you logged in and a cookie that remembers your language. No tracking or advertising cookies.