Privacy Policy

Introduction

This Privacy Policy describes how SendApp Agent ("we", "our", or "us") collects, uses, and protects your personal information.

Who is responsible for your data

The data controller is:

• Everysoft S.r.l.s.
• Registered office: Via San Giovanni Battista della Salle, 2 – 80136 Napoli (NA), Italia
• VAT number: 09856651212
• Company register: Registro delle Imprese di Napoli – REA NA-1063019
• Contact for data protection requests: info@everysoft.me

Two different roles

For your own account data — your name, your e-mail, your billing details, how you use the platform — we are the data controller, and this policy describes what we do with it.

For the data you put into SendApp Agent about your contacts and customers, you are the controller and we act as your processor under the Data Processing Agreement. It explains our duties and how to request the current sub-processor list.

Information We Collect

About you, as our customer:

• Name and surname, username, email address, phone number
• Account password (stored only as a cryptographic hash, never readable)
• Billing details: company name or personal details, VAT number, address, e-invoicing codes
• Payment information handled by Stripe or PayPal (we never see or store your full card number)
• Business sector and goal you chose at sign-up, and the plan you are on
• Technical and usage records: IP address, browser, pages visited, actions taken, error logs, message and AI usage counters
• Connection credentials for the services you enable, used to access those services on your instructions and subject to account access controls

On behalf of you, about the people you talk to (here we are your processor, not the controller):

• Your contacts: name, phone number, email address, tags, notes, custom fields
• The full content of the conversations held over your channels, including attachments, photos, voice notes and call transcripts
• Appointments, orders and leads created through your booking pages, shop and forms
• If you use SendApp Pixel on your website: the pages your visitors see and what they do there, linked to a contact only when the visitor is identified
• Where you connect a practice-management system, the patient records it mirrors — which can include data about health. You decide whether to enable that, and you remain the controller of it.

How We Use Your Information

Every use has a legal basis. These are ours:

• Providing the service — running your account, your channels, the assistant, campaigns, appointments and the apps you enable. Legal basis: performance of our contract with you (art. 6(1)(b)).
• Payments, invoicing and accounting — taking payment and keeping the records tax law requires. Legal basis: contract and legal obligation (art. 6(1)(b) and (c)).
• Service communications — telling you about your account, your limits, outages and changes to these documents. Legal basis: contract, and our legitimate interest in running the service (art. 6(1)(b) and (f)).
• Security, abuse prevention and troubleshooting — logs, rate limits, fraud and abuse checks, access records. Legal basis: our legitimate interest in keeping the platform safe, and art. 32 GDPR.
• Measurement and advertising — only if you consent to it in the cookie banner, and you can withdraw that at any time (art. 6(1)(a)).
• Tips and product news on WhatsApp or by email — only if you asked for them, with an unsubscribe in every message (art. 6(1)(a)).

We do not use the content of your conversations, your contacts or your knowledge base to train AI models, ours or anyone else's.

We do not sell personal data, and we do not take decisions about you by automated means that would have a legal effect on you.

AI Assistant Memory

Our in-app AI assistant may remember brief preferences and context about how you use SendApp Agent, such as your preferred channel or a campaign you are working on. These notes are kept for your account and may be included in requests to the AI provider when needed to answer you; they are not shared with other customer accounts.

• Stored temporarily for up to 30 days and automatically deleted if not used.
• Never include passwords, payment cards or other sensitive data.
• You can clear them at any time by asking the assistant to "forget everything".

AI Image and Video Generation

When you generate an image or a video, the description you write is sent to a third-party AI provider (currently Google) so it can produce the file. SendApp Agent does not use your descriptions to train any model, and does not share them with anyone other than the provider performing the generation.

• Your description is stored with the generation record so you can see what you asked for, retry it, and so we can respond if a generation is ever disputed or reported. Descriptions are automatically removed after 90 days; the billing record (date, model, price) is kept longer because accounting law requires it.
• Generated files are stored in your own media library, are visible only to your account, and count towards your plan storage limit. You can delete them at any time.
• The provider processes your description under its own terms and privacy policy. Do not include personal data, customer details, or confidential information in a description.
• We keep a record of each generation (date, model used, price charged) for billing and accounting purposes, as required by law.
• Refunds for AI credit and generation are governed by the AI Credit and Right of withdrawal sections of our Terms and Conditions. Statutory rights remain unaffected.

Data Sharing

We do not sell personal data. We use providers for hosting, storage and backups, security, AI features, notifications, messaging, email and SMS, payments, and analytics or advertising where you have consented. Each receives only the data needed for its activity.

A processor acts on our instructions. Messaging networks and payment providers may act as independent controllers under their own terms.

The complete, current list of providers and sub-processors, with their activities, the data processed, processing locations and safeguards for transfers outside the EEA, is available on request using the contact details below. The list is not published on this page.

To request the list or a copy of the transfer safeguards, write to info@everysoft.me.

How to obtain the sub-processor list →

Transfers outside the European Economic Area

Some providers are established or process data outside the EEA, chiefly in the United States. This includes conversation content processed by AI features and some data handled for payments and messaging.

Transfers rely on the European Commission's Standard Contractual Clauses or, where the recipient is certified, the EU-US Data Privacy Framework. The complete list specifies the safeguards for each provider and is available on request.

We may also disclose data where the law obliges us to — a court order or a lawful request from an authority — and only to the extent required.

Data We Process For You

Everything you put into SendApp Agent about other people — your contacts, the conversations with your customers, their appointments and orders — stays yours. You are the controller of it; we only process it to run the service for you.

What that means in practice:

• We act only on your instructions, and for no purpose of our own.
• We do not use it to train AI models and we never sell it.
• Only the sub-processors in the current list are involved, each for the activity indicated. The list is available on request, including before accepting the Data Processing Agreement. You are notified before a sub-processor is added or replaced, as set out in that agreement.
• Our staff can enter your account to support you. Every such access is recorded — who, which account, when and why — and the record is kept for 24 months.
• You can export or permanently erase any contact and their whole history from the platform, which is how you answer an access or erasure request you receive.
• If we ever suffer a personal data breach affecting your data, we notify you without undue delay so you can meet your own obligations.

The terms of this relationship are set out in our Data Processing Agreement, which forms part of your contract with us. You should have a copy: if you do not, ask us and we will send it.

Read the Data Processing Agreement → You can read, print and accept it from your account at any time.

Where the people you contact are located in the EU, sending them marketing needs their prior consent, and the platform gives you a place to record it and prove it. Whether you have it is your responsibility, not ours — we provide the tool, you decide who to write to.

Google User Data

When you choose to connect your Google account to SendApp Agent, we request access only to the specific Google data needed for the feature you enable, and only after you grant explicit consent through Google's OAuth screen. We never access your Google account without your authorization.

Google Ads (lead forms) — If you connect Google Ads, we use the Google Ads permission in read-only mode to import the submissions of your own Google Ads lead forms (name, phone, email and the answers of your forms) into your own SendApp Agent account, so you can reply to your leads. We never create, modify or delete campaigns, ads or budgets; campaign and ad group names are read only to label your leads.

Google Calendar — If you connect Google Calendar, we use the calendar permission solely to power two-way appointment booking on your own calendar: reading your events and free/busy availability to offer only free time slots, and creating, updating, or deleting events when your customers book, reschedule, or cancel through chat.

Google Sheets — If you connect Google Sheets, we use it only to export your own SendApp Agent contacts into a spreadsheet that we create for you, and to keep that spreadsheet updated. Using the drive.file permission, we can access only the spreadsheet our application creates — never any other file in your Google Drive.

• We access your Google data only to provide the features you explicitly enable.
• We do not sell Google user data. Transfers are limited to what is necessary for the features you enable, with the applicable safeguards, or to the other cases permitted by the Google API Services User Data Policy.
• We do not use your Google data for advertising or to train AI/ML models.
• You can disconnect a Google integration at any time to stop its use by that connection in the platform. To revoke the permissions granted at Google, also remove SendApp from your Google account connections. Disconnecting does not automatically erase data already imported; you can delete that data separately.

Fatture in Cloud

If you connect Fatture in Cloud, we use the access you grant in read-only mode (issued invoices and clients) only to send your own clients the messages you set up: the invoice when it is issued and payment reminders before and after its due dates. We read invoice number, date, amount, due dates and payment status, and each client's name, phone number and email. If you enable it, those clients are also added to your SendApp Agent contacts. We never create, change or delete anything in your Fatture in Cloud account. You can disconnect at any time, from SendApp Agent or from Fatture in Cloud (Impostazioni (Settings) → Applicazioni collegate (Connected applications)): the scheduled messages are cancelled at once. The invoice data we keep is deleted together with your account.

The SendApp Agent mobile app

The SendApp Agent app for Android and iPhone is another way into your account: it shows the same data as the web platform, with the same permissions. This section covers only what the app adds.

• Signing in — Your email or username and your password travel over an encrypted connection and are never stored on the phone. The app keeps only a session key, in the phone's protected storage (iOS Keychain, Android Keystore). Signing out, changing your password or removing the phone in Settings → Mobile app ends that session.
• Your device — To show you where your account is signed in and to protect it, we record the phone's model and name, its system and app version, its language, an identifier the app creates when it is installed, and the time and network address of its last use.
• Notifications — New-message notifications are delivered through Google Firebase Cloud Messaging and, on iPhone, the Apple Push Notification service, which receive the phone's notification token and the text of the notification. By default the lock screen shows no message text: a preview appears only if you turn it on for that phone.
• Contacts on your phone — The app reads your address book only when you use "Import from address book", after asking for your permission. You choose which contacts to import; only their name, phone number, email and birthday reach your SendApp Agent contacts. Nothing is read in the background.
• Camera, microphone and photos — The app uses them only when you scan the sign-in QR code, take a photo or video, record a voice message or pick files to send or upload. The QR code is read on the phone itself.
• QR code reader on Android — It uses Google's ML Kit, which sends Google technical diagnostic data (device model, system and app version, performance), never the content of the code.
• Files on the phone — Exports, voice messages and shared files created by the app are deleted when you sign out, and so are the images kept to show chats faster.
• No advertising, no tracking — The app contains no advertising or analytics tools and does not track you across other apps or websites.

Signed-out and expired sessions are deleted after 90 days; everything linked to the app is deleted together with your account.

Cookies

We use strictly necessary cookies to keep you signed in and to protect our forms. These require no consent and cannot be switched off.

Only with your consent do we also use measurement and advertising cookies. These are provided by Google (Google Tag Manager, Google Ads) and Meta (Meta Pixel), which act as independent controllers for them and may receive your IP address, the pages you visit and, for advertising, identifiers linked to your account. They are never set before you have given consent, and refusing them changes nothing about how the platform works for you.

Your choice is stored in a first-party cookie for 6 months. You can change or withdraw it at any time, with no explanation needed:

Change cookie preferences

Data Retention

We keep data only as long as it is needed for what it was collected for:

• Account and profile — while your account is active. After an account deletion request, deletion follows the 30-day procedure in the Data Processing Agreement, subject to legal retention duties. Plan expiry alone is not a deletion request; the Agreement limits retention after expiry to two years.
• Conversations, attachments and call transcripts — retention is governed by the period configured for your account and the Data Processing Agreement. You can delete them yourself or request deletion; ask us to confirm the applicable period and automatic-deletion status for your account.
• Contacts and their consent records — until you delete them. The record proving a consent, or its withdrawal, is kept for as long as you are relying on that consent, because without it the consent cannot be demonstrated.
• Invoices, payments and message-credit ledgers — 10 years from the transaction, as Italian tax and accounting law requires. This survives the deletion of your account, with the link to you removed where it is no longer needed.
• Unsubscribe and suppression lists — we retain the minimum information necessary to respect an objection or withdrawal for as long as it remains necessary to prevent further unwanted messages. This does not justify retaining the full contact profile or conversation history.
• Security and access logs — up to 24 months, then deleted.
• Descriptions used for AI image or video generation — 90 days; the billing record of the generation is kept for the accounting period above.

You can ask us to delete something sooner — see Your Rights below.

Data Security

We implement multiple security measures to protect your personal information:

• Encrypted connections and cryptographic protection of passwords
• Protected database access
• Access controls, abuse prevention and security monitoring
• Secure data transmission

Your Rights

You may exercise the following GDPR rights where their legal conditions apply. Requests are normally free. We respond within one month; if a request is complex or numerous, the law permits an extension of up to two further months, and we inform you within the first month with the reasons. We may need information to verify your identity.

• Access (art. 15) — a copy of the data we hold about you, and the information in this policy in relation to your own case.
• Rectification (art. 16) — correction of anything inaccurate or incomplete. Most of it you can edit yourself in your profile.
• Erasure (art. 17) — deletion of your data, including deletion of your whole account from your profile page. Data we must keep by law — invoices above all — is the exception, and we tell you which.
• Restriction (art. 18) — having us pause the use of your data while a dispute about it is resolved.
• Portability (art. 20) — your data in a structured, machine-readable format, which you can export yourself.
• Objection (art. 21) — objecting to any use we base on a legitimate interest. Against direct marketing the objection is absolute: we stop, no questions asked.
• Withdrawing consent (art. 7(3)) — at any time, as easily as you gave it, for anything based on consent — cookies, tips, product news. Withdrawing does not affect what was lawful before.

To exercise any of them, write to info@everysoft.me.

If you are not satisfied with our answer, you can lodge a complaint with a data protection authority — in Italy the Garante per la protezione dei dati personali (garanteprivacy.it) — or with the authority of the country you live or work in. You can also go to court.

If you are one of our customers' contacts, and not a customer yourself: the business that contacted you is the controller of your data, and we act on their instructions. Send your request to them. If you cannot reach them, write to us and we will pass it on and tell you who they are.

Data Storage

The platform itself — the database, the application servers, your conversation archive — runs on servers located in the European Union.

Some providers are established or process data outside the EEA, chiefly in the United States. For example, an AI assistant sends the conversation content needed for a reply to its model provider. The current provider list and transfer safeguards are available on request using the contacts in this policy.

If your use case cannot tolerate a transfer outside the EEA, contact us before enabling the AI features: some of them can be switched off for your account.

Contact Us