We are the data controller for the personal information described in this policy. By using the Service you agree to the practices described here. If you do not agree, please do not use the Service.
1. Who we are
Undropoff is a customer-relationship platform that lets a business hold conversations with its customers, staff, and colleagues across connected channels (such as email and WhatsApp), manage contacts and tasks, and optionally use AI assistants to help draft and send replies on those channels.
Contact us about privacy at privacy@undropoff.com. Our registered address is TODO — Street, City, Country.
2. Information we collect
Information you give us
- Account & profile data — name, email address, and authentication identifiers when you create or are invited to an account.
- Contact & conversation data — the contacts you add or import (names, email addresses, phone numbers, tags, notes) and the content of messages sent and received through connected channels.
- Content you upload — files, avatars, and attachments you add to conversations or contacts.
Information we collect automatically
- Usage & device data — log data, IP address, browser type, and actions taken in the Service, used to operate, secure, and improve it.
- Cookies & similar technologies— used for authentication and to keep you signed in. See “Cookies” below.
Information from connected services
When you connect a third-party channel or sign-in provider, we receive only the data needed to operate that connection — for example, the tokens and account identifiers required to send and receive messages on your behalf, and the message content that flows through the channel.
3. How we use information
- To provide, maintain, and secure the Service.
- To send and receive messages on the channels you connect, and to surface conversations, contacts, and tasks in your dashboard.
- To operate AI assistant features you enable — drafting and, where you have authorised it, sending replies on your behalf.
- To authenticate users and prevent fraud and abuse.
- To provide support and respond to your requests.
- To comply with legal obligations.
We do not sell your personal information, and we do not use the content of your messages or contacts for advertising.
4. Legal bases for processing
Where data-protection law (such as the GDPR or POPIA) applies, we rely on: performance of our contract with you; your consent (which you may withdraw at any time); our legitimate interests in operating and securing the Service; and compliance with legal obligations.
5. AI features
Some features use third-party AI models to draft and send replies. When you use these features, relevant conversation and contact context is sent to our AI processors solely to generate the response you requested. We do not permit these processors to use your data to train their general-purpose models. AI assistants only act automatically where an administrator has explicitly enabled that for a given contact and channel.
6. How we share information
We share personal information only as described here:
- Service providers (sub-processors) — vendors who host and run the Service on our behalf, under contract and bound to protect your data, including: authentication, database/backend hosting, message delivery (email and messaging providers), file storage and content delivery, and AI model providers.
- Within your organisation — data is visible to other authorised members of your organisation and spaces, according to their access.
- Legal & safety — where required by law, or to protect rights, safety, and the integrity of the Service.
- Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.
7. Meta / WhatsApp data
If you connect WhatsApp, we use the WhatsApp Business Platform to send and receive messages. Message content and the phone numbers involved are processed only to deliver those messages and show them in your dashboard. Our use of information received from Meta APIs follows Meta's Platform Terms and Developer Policies. We retain WhatsApp message data only as long as needed to provide the Service, and you may request its deletion as described in “Your rights” below.
8. Google API data & Limited Use
If you connect a Google account, Undropoff's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only request the scopes needed to provide features you use, we do not transfer or use Google user data for advertising, and we do not allow humans to read it except with your consent, for security, to comply with law, or as needed to operate the feature you requested.
9. Data retention
We keep personal information for as long as your account is active or as needed to provide the Service, then delete or anonymise it within a reasonable period, unless a longer retention period is required by law. You can delete contacts, messages, and other content from within the Service.
10. Security
We use industry-standard measures — encryption in transit, access controls, and reputable infrastructure providers — to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
11. International transfers
Your information may be processed in countries other than your own, including where our service providers operate. Where required, we put appropriate safeguards in place for such transfers.
12. Your rights
Depending on where you live, you may have the right to access, correct, delete, export, or restrict processing of your personal information, and to object to certain processing or withdraw consent. To exercise these rights — including to request deletion of your data — email privacy@undropoff.com. We will respond within the timeframe required by applicable law. You also have the right to complain to your local data-protection authority.
13. Children
The Service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us data, contact us and we will delete it.
14. Cookies
We use strictly necessary cookies to authenticate you and keep you signed in. We do not use cookies for third-party advertising.
15. Changes to this policy
We may update this policy from time to time. We will post the new version here and update the “Last updated” date. Material changes will be communicated where appropriate.
16. Contact us
Questions about this policy or your data? Email privacy@undropoff.com or write to us at TODO — Street, City, Country.