Privacy Policy

1. Who this notice covers and who controls your data

a. Business Customers and Authorized Users

This notice covers the company, organization or person that installs our widget, subscribes to our software or uses our dashboard and related services (“Business Customer”), and its administrators, employees, contractors and agents (“Authorized Users”). It explains our handling of account, billing, support, security and service-use information, as well as information processed through the platform.

b. End Users and website visitors

This notice also covers people who visit our website or communicate through an Aivagenta™-powered website widget, AI chatbot, phone call, SMS, WhatsApp, email, form, booking flow or related tool (“End Users”). It applies whether you communicate with AI, a human agent, the Business Customer or Aivagenta™ directly. You do not need a dashboard account for your information to be processed.

c. Our roles and the business’s notice

A Business Customer generally decides why and how its customer conversations, contact records, bookings, tickets and sales activity are used. For those purposes, it generally acts as controller and Aivagenta™ processes personal data on its behalf under its instructions. An effective Data Processing Agreement governs that processing where applicable. If the Business Customer is itself a processor, Aivagenta™ may act as its subprocessor. Legal roles depend on the actual activity, not only the label in a contract.

Aivagenta™ acts as an independent controller for its own website, business account administration, billing, direct support, security and legal compliance activities where it determines the purposes and means. Aivagenta™ is also the business responsible for conversations about its own products and support. Independent carriers or other providers may have separate controller responsibilities for their own regulated or account activities.

Read the notice of the business you contact for its own purposes, legal bases, retention, connected applications and rights contact. This policy does not replace that notice or cover unrelated third-party websites. It explains data practices; reading it or using a widget is not blanket consent to every form of processing. Our Terms of Service separately address use of the software and customer-facing tools.

2. Information collected and where it comes from

a. Business account and support information

We receive information supplied by Business Customers and Authorized Users, such as name, business identity, contact details, login credentials, role and permissions, subscription choices, billing and transaction information, support requests and correspondence. Payment information is handled through the payment method and checkout providers used for the transaction. Do not send card security codes or passwords in a support conversation.

b. Conversations and customer records

Depending on the channels and features used, information may include names, email addresses, phone numbers, messages, attachments, contact preferences, requests, booking details, service addresses, business knowledge, documents, tickets, CRM records, agent notes, AI prompts and responses, summaries and escalation history. Phone services also process call routing and connection information, caller and destination numbers, timing and duration, and recordings or transcripts where enabled and lawfully disclosed. A voice interaction does not necessarily mean a stored recording is enabled.

The business and its Authorized Users may see the content you send and use it to respond, follow up or deliver the service you request. Avoid sending unnecessary sensitive information. Content you volunteer can include information about other people; share it only when authorized and appropriate.

c. Browser, device, usage and visitor context

The Services may receive IP address, browser and device information, timestamps, referring pages, visited pages, session identifiers, interaction events and diagnostic or security logs. When visitor-context or sales features are enabled, page context, browsing activity, scrolling and interest signals may inform a HeatScore™ or other prioritization signal, proactive message, relevant offer or follow-up. Such a signal estimates interest from activity; it is not a verified statement about a person’s intentions or financial circumstances.

d. Other sources and connected services

We receive data from the Business Customer, its Authorized Users, communications providers and applications the business connects or instructs us to use. This may include existing contacts, conversation history, delivery status or task results. Connecting an application can send data in both directions. The business must identify its own sources and connections in its notice as required. The sources and information depend on the services actually enabled.

3. Purposes, AI processing and limits on use

a. Delivering the requested service

For a Business Customer, we process information to configure and operate its account, authenticate and authorize users, supply its selected services, administer billing and provide support. On its instructions, we route calls and messages, generate AI replies and assistance, translate or summarize conversations, create tickets and CRM records, support booking and follow-up actions, and provide configured visitor-context, sales and integration functions. A conversation may move between AI, human agents and connected tools while keeping relevant context.

b. Safety, administration and communications

For our own purposes, we use relevant account, operational and support information to troubleshoot, maintain reliability, understand service performance, protect accounts, detect abuse, administer our relationship, communicate necessary service information and comply with law. Marketing or newsletters require the permission or other lawful basis applicable to that communication, with an available opt-out. We do not treat a customer-service inquiry as permission for unrelated promotional contact.

c. AI, profiling and consequential decisions

AI providers may process the relevant prompt, conversation context, uploaded knowledge or other information needed for the selected feature. AI can produce inaccurate information and inferred interest scores can be wrong. The Business Customer decides how to use its configured sales signals, suggestions and automations and must supply any required information and safeguards for its own profiling or automated decisions. Aivagenta™ does not authorize using these tools as the sole basis for a decision with legal or similarly significant effects without the lawful safeguards required for that use. See your rights.

d. Purpose limits

We do not sell personal information. This notice does not authorize Aivagenta™ to use Customer Content for its own behavioral advertising or to train a shared general-purpose AI model. Any materially different use requires a separate lawful basis and any required notice and consent. Processing by a provider remains subject to the applicable arrangements and configuration; this policy does not assert that a provider account has zero data retention. Processing customer content to supply and support the selected service is distinct from permission to reuse it for unrelated purposes.

4. Legal bases where European data-protection law applies

When Aivagenta™ acts as controller and the GDPR or a comparable law applies, the basis depends on the purpose and the individual’s relationship with us. We rely on contract where processing is necessary to perform a contract with you or take steps you request before entering one; legal obligation where processing is required by law; and legitimate interests, subject to the required assessment and balancing, for appropriate business administration, fraud prevention, security, troubleshooting and service reliability. For business contacts who are not themselves the contracting party, legitimate interests may be the relevant basis for relationship administration rather than a contract with their employer being treated as a contract with them.

Where consent is required, such as for particular non-essential tracking, marketing, recording or other optional processing, the responsible party must obtain a valid, specific choice before that processing. Consent may be withdrawn without affecting earlier lawful processing. Legitimate interests are not a substitute where the law requires consent. A privacy notice or acceptance of general Terms does not supply that consent.

When we process End User information for a Business Customer, that business must determine and explain its lawful basis and give lawful instructions. Our service agreement with the business is not automatically an End User’s legal basis. If information is required to administer an account, complete a requested action or comply with law, not providing it may prevent that activity; optional fields or processing should be identified by the responsible business.

5. Recipients, providers and disclosure

a. The business you contact

Your communications and relevant activity may be available to the Business Customer and its Authorized Users according to their permissions, and to applications it connects to handle the interaction. A message to one business is not intentionally published to other businesses merely because they also use Aivagenta™. The recipient business is responsible for its own onward use and disclosures.

b. Providers supporting the Services

Providers receive information needed for their functions, subject to applicable contracts, confidentiality requirements and processing instructions. The current service-provider inventory includes Hosting.com (formerly A2 Hosting) for managed hosting of the application, marketing site, databases and uploads; OpenAI for AI processing; Twilio for phone and messaging functions; Pusher for real-time delivery; and Mailgun for email. The data sent depends on the feature: for example, an AI request may include message context, while a communication provider may receive message content, destination and delivery metadata.

Checkout, payment and other separately selected connected services receive information necessary for the transaction or authorized connection. A business’s own connected applications are separate from Aivagenta™’s provider inventory. Specific contracting entities, enabled products, account regions and applicable transfer terms should be confirmed for a deployment; the DPA provider schedule records the available information and items requiring confirmation.

c. Other permitted disclosures

We may disclose relevant information when legally required, to establish or defend legal claims, or where necessary and lawful to investigate abuse or protect people and the Services. We assess requests and limit disclosure as required by applicable law. Information may be transferred in a proposed or completed merger, financing, reorganization or sale, subject to appropriate protections and notice where required. A transaction does not itself authorize an incompatible new use of previously collected personal data.

We do not disclose customer conversations or contact information for third parties to purchase for their own advertising. Necessary disclosures to hosting, AI, communications and other service providers are distinct from a sale of a contact list.

6. Retention, deletion and account closure

We retain information only for as long as needed for the applicable purpose, documented instructions and legal obligations. The relevant criteria include whether an account remains active; the business’s instructed conversation, ticket, CRM and recording needs; unresolved support requests; security and fraud investigations; accounting or other legal requirements; legal claims; and any valid preservation requirement.

Retention periods vary by data category, selected service, provider arrangement and the business’s instructions. Ask the responsible business or privacy@furie.ai for the retention information applicable to your interaction or deployment. The applicable DPA schedule must establish the agreed return and deletion details, including active records, logs and backups.

Closing a widget, ending a call, opting out of messages or deleting a dashboard login does not automatically erase every associated record. On a valid request or at the end of service, deletion or return is handled under applicable law and an effective DPA, including any justified legal hold. Backup copies may persist until the applicable backup cycle expires; their actual expiry and restrictions must be established in the relevant arrangements. Copies already sent to a business or independently controlled connected service are subject to that recipient’s own obligations. See requesting deletion.

7. Your rights, choices and request routes

a. Rights that may apply

Depending on applicable law and the circumstances, you may request information about processing; access and a copy; correction; deletion; restriction; portability; or an objection to particular processing, including direct marketing. You may withdraw consent where it is the basis for processing. Where applicable, you also have rights concerning solely automated decisions with legal or similarly significant effects, including appropriate human involvement and a way to contest a decision. Rights are subject to legal conditions and exceptions; a request does not always require deletion of records that must lawfully be retained.

b. Who to contact

For a conversation, booking, ticket, CRM record, recording or visitor activity controlled by a business using Aivagenta™, contact that business first using its website or notice. It normally decides the response, and we assist as required by its instructions, our agreement and law. For your Aivagenta™ account, our website, our own support or processing we control, email privacy@furie.ai. If you do not know which business is responsible, give us the website, channel and approximate interaction date so we can help identify or route the request. We remain responsible for our own legal duties.

Describe your request and provide only the information reasonably needed to locate the records and verify your identity or an authorized representative’s authority. Do not email a password or unnecessary identity documents. We will explain if more verification is needed. We respond within applicable legal time limits and explain any lawful refusal or extension. You may complain to a competent privacy regulator; see GDPR details for European rights and response times. Where local law provides a privacy-request appeal or additional rights, contact us to exercise them; we will handle them as applicable.

c. Communication and tracking choices

Use an available unsubscribe link, supported STOP instruction, consent control or the business’s contact details to change optional communications and tracking choices. For Aivagenta™’s own marketing, contact privacy@furie.ai. A request to stop promotional messages does not necessarily stop necessary account, transaction or security notices, subject to law. Necessary service processing may continue on another valid basis after optional consent is withdrawn. Exercising a privacy right does not by itself require you to buy a subscription or give up mandatory rights.

8. Cookies, browser storage and widget consent

Our websites and widgets may use cookies or similar browser storage for session continuity, authentication, consent choices, selected preferences and configured visitor-context features. The widget uses property-scoped browser storage for consent and session identifiers and may store supplied guest details. Consent and session events can be transmitted to the service. Our marketing site also stores an optional preference for pausing icon animations. Aivagenta™ storage is separate from storage used by the Business Customer’s own website or other vendors.

When enabled, the widget’s GDPR mode presents a consent choice before gated chat features run. It is a consent workflow, not a guarantee that no data is transmitted or retained. The business installing it must assess what happens on page load and during the interaction and obtain any consent required before non-essential collection or access to device storage. Enabling a setting does not by itself establish GDPR compliance.

You can use available consent controls and browser settings to manage cookies or local storage. Clearing storage may remove a saved choice and session continuity; it does not delete server-side records. Blocking storage may affect functionality. Non-essential tracking must be disclosed and controlled as required by applicable law. Consult the business’s notice and available consent controls for the tools active on its website.

9. Security, confidentiality and access

We are responsible for security measures appropriate to the processing risks and our applicable legal and contractual duties. Access and handling must be limited to authorized purposes and people. Business Customers also manage account permissions, credentials, their own devices and integrations, and lawful deployment settings.

No internet service can guarantee absolute security. The security schedule in an effective DPA should document the measures applicable to the deployment. Contact our privacy team for relevant security information or to report a suspected privacy or data-security incident, including the service and facts needed to investigate without unnecessary personal data. Notifications and assistance will be handled as required by applicable law and the relevant agreement.

10. Locations and international processing

Our application, marketing website, customer databases and uploads are hosted on Hosting.com managed Linux servers in the Eastern United States. Other service providers, connected applications, support access and backup arrangements may involve other locations. Their actual products, account regions, access locations and retention settings must be confirmed for the relevant deployment; the hosting location alone does not establish every place data is processed.

When a transfer requires a safeguard under applicable data-protection law, the responsible parties must establish a valid mechanism, such as an applicable adequacy decision or appropriately completed Standard Contractual Clauses and any necessary supplementary measures. We do not assume that a provider participates in a certification framework or that linking to a document executes it. Our DPA addresses transfer requirements, and you can contact privacy@furie.ai for the arrangements applicable to your data. Use of a U.S.-hosted service does not itself supply consent to a restricted international transfer.

11. Children and sensitive information

The Services are intended for general business communications, not services directed to children under 16. Business account holders must meet the eligibility requirements in the Terms. We do not knowingly seek children’s personal information through our own general-audience services. A business must not configure a child-directed use or knowingly submit children’s data without a separately agreed lawful arrangement and the notices, permissions and safeguards required for that use. An age statement alone does not replace applicable children’s privacy duties.

If you believe a child has provided personal information without required authorization, contact the responsible business and privacy@furie.ai so the issue can be investigated and appropriate access, restriction or deletion steps considered. Do not include more information about the child than necessary in the initial request. General chat and messaging tools should not be used to send unnecessary health, financial, identity or other sensitive details; any specialized processing requires suitable instructions and safeguards.

Aivagenta™ SMS Messaging Opt-In Disclosure

How Users Opt In

For Aivagenta™’s own support SMS line, sending an inbound support text requests conversational replies about that inquiry. It is not an opt-in to unrelated marketing or to messages from every Business Customer using our software. Any additional consent legally required for a particular communication must be obtained separately.

What Messages Are Sent

Our support program sends customer-support responses and account or service assistance, not promotional campaigns. A Business Customer’s separately configured program may send different permitted messages and must give its own sender identity, purposes, consent disclosure and opt-out information. An AI or automated reply may be used as disclosed for the interaction.

Opt-Out Instructions

For supported SMS programs, reply STOP to opt out and HELP for help, or contact the sender using its published details. Contact privacy@furie.ai about Aivagenta™’s own support program. Other reasonable withdrawal methods must be honored when required by law. A neutral opt-out confirmation may be sent where permitted. Consent to marketing is not a condition of purchase where prohibited by law.

Message Frequency

Support message frequency varies with your inquiry. Message and data rates may apply under your carrier plan, and carriers do not guarantee delivery. The business operating any other program must disclose its own applicable frequency and terms.

Data Privacy

Support numbers, message content and delivery information are used to handle the inquiry and necessary administration, security and legal obligations. Communications and hosting providers may process them to deliver the service. We do not sell support numbers or transfer SMS opt-in consent to third parties for their own marketing. Withdrawal stops the relevant messaging as required; it does not necessarily delete support or legal records. The retention and rights sections above explain how to request deletion.

12. Changes to this notice

We will update the date above when this notice changes and give additional notice of material changes through an appropriate channel as required. A new posting does not silently authorize an incompatible use of data collected under an earlier notice. Where a proposed change requires consent or another legal step, the responsible party must complete it before that processing. Continued use alone is not treated as consent to every new data practice.

Business Customers must keep their own End User notices accurate and arrange any necessary communication or renewed consent when their configuration or purposes change. This policy and our service agreement do not replace that obligation or Aivagenta™’s own transparency duties.

13. Contact

Privacy contact: Aivagenta, Inc., privacy@furie.ai.

Website: www.aivagenta.com.

For contractual or billing questions, contact legal@furie.ai. For personal-data requests about the business you contacted, follow the request routes in section 7. If you need the relevant controller identity, processing details or applicable DPA and safeguards, tell our privacy contact which service or interaction you are asking about.