Privacy Policy

1. Scope

This Policy applies when Assis processes personal information through the Services - for example when a business connects Assis, when someone visits our website or contacts us, or when customer messages and related data are processed through Assis channels (Website Plugin, Website Chat, WhatsApp, Email, and other supported channels).

Depending on the plan (Powered by Assis or Care by Assis) and settings, an interaction may be handled by Assis AI, the business or its representatives, Assis representatives, or a combination. Storage of an interaction in Assis does not by itself mean an Assis representative handled it.

Where Assis processes customer data on behalf of a business, that business's own privacy notice also applies, and many individual requests should be directed to that business first. Processing on behalf of businesses is further governed by the Assis Data Processing Agreement.

2. Information We Collect

Depending on how the Services are used, we may collect and process:

We may receive this information from you, from the business using Assis, automatically through use of the Services or website, from connected platforms and integrations, or from publicly available business sources when a business authorizes knowledge-base features such as website scanning.

Assis messaging channels are free-text. Content that users or businesses choose to send (including unnecessary or sensitive details) may be received and stored as part of providing the Services. Please avoid sharing information that is not needed.

3. How We Use Information

We use personal information to:

• Provide, operate, maintain, authenticate, and secure the Services
• Receive, store, display, route, and manage customer inquiries and history
• Enable businesses and their representatives to provide customer care through Assis
• Provide Assis human care under Care by Assis, including Care workflows (tasks, questions, statuses, records) where included
• Operate Assis AI and automation to understand, classify, respond to, and assist with inquiries
• Build and operate a knowledge base and display relevant order, product, shipping, and policy context
• Send proactive messages on a business's behalf where configured (for example abandoned cart, order or shipping updates, return/refund updates, support follow-ups, and other transactional, operational, or authorized promotional messages). The business is responsible for ensuring it has the rights, notices, consents, and legal bases required for such messages
• Operate integrations and respond to platform events and webhooks (including e-commerce apps such as Shopify). If a platform requires deletion or data-request workflows on uninstall or customer request, Assis will handle them under that platform's rules, this Policy, the DPA, and applicable law
• Process billing, subscriptions, and business account support
• Monitor performance, prevent fraud or abuse, troubleshoot, and improve reliability
• Analyze usage; research and develop the Services; and improve Assis AI as described in Section 4
• Create aggregated, anonymized, or de-identified information for analytics, security, and product improvement
• Operate the Assis website and measure marketing or analytics as described in the Cookie Policy
• Comply with law, enforce agreements, and protect rights and safety

Assis processes personal information only as permitted by applicable law and applicable agreements with businesses.

4. Artificial Intelligence

Assis uses AI and automated systems as part of the Services. Inquiries may be processed to understand and classify them, identify relevant information, generate or suggest responses, perform supported actions, route messages, trigger proactive messages, or identify when human help may be needed. Further handling depends on the business's plan and settings. AI may produce incomplete or inaccurate results; humans may review interactions where applicable.

Assis may use conversations, historical support materials, and related service data to operate and improve AI features for the business that provided or generated that data (for example knowledge-base configuration, response quality, routing, and similar service features for that business).

Assis may also use aggregated, anonymized, or de-identified information to improve the Services and Assis AI more generally.

Where Assis acts as processor / service provider for a business, any use of that business's Customer Personal Data for model training or fine-tuning is limited to what applicable law and the Assis-business agreement (including the DPA) permit. Assis does not claim a broader right to use Customer Personal Data for AI training than those documents allow.

5. Roles of Assis and the Business

When a business uses Assis to process information about its customers, the business typically acts as controller (or equivalent), and Assis acts as processor, service provider, contractor, or similar role - whether an inquiry is handled by the business, Assis AI, Assis representatives, or a combination, and whether messages are reactive or proactive.

The business should provide appropriate privacy notices to its customers (including at or before collection where required by law) and obtain any consents required by law. For information Assis processes for its own purposes (for example account administration, billing, security, legal compliance, website operations, and, where Assis is an independent controller, certain product analytics or AI improvement using permitted data), Assis may act as an independent controller.

6. Sharing and Access

Access is limited based on permissions, roles, and selected services. Information may be accessible to the business and its authorized users; Assis personnel who need access to operate, support, secure, or improve the Services (including Care representatives where applicable); and service providers / subprocessors.

We may use service providers for cloud hosting, security and monitoring, communications and messaging (including WhatsApp/Meta and email providers), AI and technology services, analytics and logging, payment and billing for business subscriptions, e-commerce and other integrations, and support tooling. They may process information only as needed to provide their services, under appropriate contractual and security requirements.

We may also disclose information when required by law or lawful request; to protect rights, safety, or security; to detect or investigate fraud, abuse, or security incidents; or in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to applicable law.

We do not sell personal information for money. Some website analytics or advertising cookies may be treated as "sharing" or targeted advertising under certain U.S. state laws (including California). Where that applies, available controls are described in the Assis Cookie Policyand, where required, on the Website. Assis does not add a separate "Do Not Sell" link unless required by how cookies or other tools are actually configured.

7. Cookies

Assis uses cookies and similar technologies on its websites as described in the Assis Cookie Policy, including categories, purposes, consent where required, and how to manage preferences. Cookie practices on the Website should match that Cookie Policy.

8. Retention and Deletion

We retain information as reasonably necessary to provide the Services, maintain history, operate and secure the platform, fulfill contracts, resolve disputes, and comply with law. Exact periods may vary; Assis applies the following principles:

• Account and business profile data - while the account is active, and for a reasonable period after closure or termination as needed for wind-down, disputes, security, and legal obligations
• Customer conversations and related support records - according to the agreement with the business, operational needs to provide support history, platform requirements, and legal or security needs
• Billing and subscription records - for as long as needed for accounting, tax, audit, and other legal requirements
• Security and system logs - for a period reasonably needed for security, troubleshooting, and compliance
• Website and marketing contact data - while needed to respond to inquiries or manage the relationship, and then as needed for legitimate business or legal purposes
• Backups - retained according to Assis backup cycles and overwritten or deleted in the ordinary course; deletion from backups may lag live-system deletion

Businesses may request deletion of information stored in the platform, subject to agreements and law. Where Assis processes information on behalf of a business, customer access, correction, or deletion requests may need to go to that business first; Assis will assist as required.

If a business disconnects or uninstalls Assis (including from an e-commerce platform), Assis will delete or anonymize related store and customer data within a reasonable period consistent with platform requirements, the DPA, backups, security logs, and legal retention needs. Some information may be retained where required or permitted by law.

9. Security

We use technical and organizational measures designed to protect personal information against unauthorized access, use, alteration, loss, or disclosure, including access controls, encryption in transit and/or at rest where appropriate, monitoring, and authentication. No method of transmission or storage is completely secure. If a security incident occurs, we will investigate and provide notices where required by law.

10. International Transfers

Assis is based in the United States. Information may be processed or stored in the United States and other countries. Where required (including under GDPR), Assis uses appropriate transfer safeguards, which may include Standard Contractual Clauses or other lawful mechanisms.

11. Your Rights

Depending on applicable law and where you live, you may have rights to access, correct, delete, or port personal information; restrict or object to certain processing; withdraw consent where processing is based on consent; opt out of certain processing or targeted advertising; and lodge a complaint with a supervisory authority. Rights are subject to legal conditions and exceptions.

Requests: accountant@assis.care. We may need to verify identity. If Assis processes your information on behalf of a business, contact that business first when required; Assis will assist the business as required by law and contract.

EEA / UK (and similar laws): where Assis is controller, legal bases may include contract, legal obligation, legitimate interests, and consent where required. Where Assis is processor for a business, that business generally determines the legal basis and responds to rights requests, with Assis assistance.

California and other U.S. state laws:residents may have rights to know, access, correct, delete, and not be discriminated against for exercising privacy rights, subject to exceptions. Assis does not sell personal information for money. This Policy is one part of California compliance; where Assis collects personal information as a business, notices at collection and any required opt-out mechanisms must match actual practices. For website cookies that may involve "sharing" or targeted advertising, see the Cookie Policy.

12. Children

The Services are not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If we learn that such information has been collected, we will take reasonable steps to delete it.

13. Changes

We may update this Policy from time to time. The date at the top shows the latest update. Where a material change requires notice under applicable law, we will provide appropriate notice.

14. Contact

For privacy questions or requests: