AssistApp Privacy Policy

AssistApp is the trading name of Norsey Technologies Limited, a company registered in England and Wales under company number 17507180.

Our registered office is 35 Chapel Court, Billericay, England, CM12 9LX.

In this policy, “AssistApp”, “we”, “us” and “our” refer to Norsey Technologies Limited.

AssistApp provides AI powered customer service, messaging automation and booking software to businesses. Our services help businesses answer customer enquiries, manage bookings, respond to messages and connect customer communications with relevant business systems.

This Privacy Policy explains how we collect, use, store and protect personal data through our website, software and integrations, including WhatsApp.

We handle personal data in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Depending on how you use AssistApp and the features enabled by a business using our services, we may collect or process the following information:

• Contact information, such as names, telephone numbers and email addresses.
• Message information, including messages, questions, replies, attachments and relevant conversation history exchanged through WhatsApp or other supported messaging channels.
• Booking information, such as booking dates and times, requested services, availability, booking references, cancellations, changes and other information needed to manage a booking.
• Business information, such as business names, contact details, services, opening hours, pricing, booking rules and other information supplied by our business clients.
• Technical information, such as timestamps, message delivery information, error reports, service logs and technical information needed to operate and secure our systems.
• Website enquiries, including information you provide when contacting us about our services or requesting a demonstration.

We do not collect or store customers’ payment card details or payment credentials. Where a booking requires payment, payment is handled directly by the business’s existing payment provider. We do not process payment card information. We may process limited booking status or transaction reference information where necessary to support a booking.

Customers do not need to create an AssistApp account or set up a password to use our public booking service. However, customers may provide contact details or other information when making a booking or sending a message.

We only process personal data that is relevant to the purposes described in this policy.

We use personal data to provide and operate our AI powered messaging and customer service software; receive, process and respond to customer messages; answer questions about a business’s services, opening hours, pricing, availability and policies; create, amend and cancel bookings where these features are enabled; connect with businesses’ existing booking systems and other authorised services; provide booking confirmations and relevant customer service communications; produce service performance reports and business analytics; maintain, troubleshoot and secure our systems; respond to enquiries from prospective and existing business clients; and comply with legal obligations and protect our legitimate business interests.

We do not sell personal data to third parties.

AssistApp may analyse customer enquiries, messaging activity and booking information to provide business clients with useful reports and insights.

Where possible, these reports use aggregated or anonymised information rather than information that identifies individual customers. Examples include the types of questions customers commonly ask, frequently requested services, the busiest and quietest times of day or days of the week for bookings, booking demand, cancellations and general customer service trends.

Our business clients can use these insights to make better informed decisions about staffing, availability, customer service and how they operate their businesses.

We aim to ensure that information described as anonymised no longer identifies an individual and that individuals cannot reasonably be identified from it. Where information remains personal data, we continue to handle it in accordance with this Privacy Policy and applicable data protection law.

AssistApp integrates with WhatsApp Business Platform to enable businesses to communicate with their customers.

When a customer messages a business using AssistApp, information such as their telephone number, message content, relevant conversation history and message metadata may be transmitted to our systems so that we can process the request and generate a response.

Messages may be processed by our application, stored in our database and passed to third party AI services to generate responses. Where a booking or other request is made, relevant information may also be processed by the business’s booking system or another authorised integration.

Meta and WhatsApp process information in connection with the delivery and operation of their messaging services under their own applicable terms and privacy policies.

We use information obtained through messaging integrations only as necessary to provide our services, support our business clients, maintain security and meet our legal obligations. We do not use WhatsApp customer data for our own unrelated advertising purposes.

Businesses using AssistApp are responsible for obtaining any consent or opt in required to message their customers on WhatsApp, and for complying with the WhatsApp Business Terms of Service, the WhatsApp Business Messaging Policy and other applicable Meta terms and policies.

For further information, please refer to the Meta Privacy Policy at https://www.facebook.com/privacy/policy/ and the WhatsApp Privacy Policy at https://www.whatsapp.com/legal/privacy-policy.

AssistApp uses artificial intelligence to process customer enquiries and generate responses on behalf of businesses.

Depending on the service and its configuration, relevant message content, conversation context and business information may be processed by third party AI providers to generate responses. These providers may process data in more than one country, as described in section 10.

AI generated responses may occasionally be inaccurate or incomplete. Businesses remain responsible for their services, customer policies and decisions made when using our software.

We do not use customer conversations to train our own AI models unless this is separately disclosed and an appropriate legal basis has been established.

Third party AI providers may process personal data on our behalf, subject to applicable contractual arrangements and data protection requirements.

AssistApp primarily provides software to businesses that use our services to communicate with their customers.

For customer information processed on behalf of a business client, that business will generally act as the data controller, determining why and how the personal data is used. AssistApp will generally act as a data processor, processing that information on the client’s instructions.

The relevant business is responsible for ensuring that it has an appropriate lawful basis for processing its customers’ information, provides any required privacy information and complies with its own data protection obligations.

AssistApp acts as a data controller for information we process for our own purposes, such as managing business relationships, responding to enquiries, maintaining our website and protecting our systems.

Where applicable, we enter into data processing agreements with our business clients to establish the responsibilities of each party.

If you have a question about information processed by a business using AssistApp, you should normally contact that business first. We will assist our clients with data protection requests where required.

Under the UK GDPR, we rely on one or more of the following lawful bases, depending on the purpose of the processing:

• Contract, where processing is necessary to provide our services or take steps requested before entering into a contract.
• Legitimate interests, where processing is necessary for our legitimate business interests, such as maintaining security, troubleshooting our software, improving service reliability and managing business relationships, provided those interests do not override individuals’ rights.
• Legal obligation, where processing is necessary to comply with applicable laws or regulations.
• Consent, where we rely on consent for a particular purpose, including where consent is legally required for certain cookies or communications.

Where we process personal data on behalf of a business client, the client is generally responsible for determining the appropriate lawful basis for that processing.

We use third party service providers to host, operate and support AssistApp. Our current providers include:

• Vercel: application hosting and deployment. Our application is deployed in London, United Kingdom.
• Supabase: database hosting and storage. Our database is hosted in the EU West 1 region in Ireland.
• Meta and WhatsApp: messaging services, including transmission of customer messages between businesses and their customers. Processing locations depend on the services and infrastructure used by Meta.
• Third party AI providers: processing relevant message content and business information to generate AI responses. These providers may process information in the United States and other countries, depending on their infrastructure and service configuration.

We may also use other authorised providers where necessary to support bookings, integrations, security and technical operations.

We share personal data with these providers only where reasonably necessary to operate our services, fulfil our contractual obligations, comply with the law or protect our legitimate interests. We take reasonable steps to ensure that providers handling personal data are subject to appropriate contractual, confidentiality and security requirements.

We operate our application and database environment using third party infrastructure providers. Our application is deployed in London, United Kingdom, and our Supabase database is hosted in Ireland.

Some providers, including third party AI providers and messaging platform providers, may process personal data in other countries, including the United States. The location may depend on the provider, service and configuration. Data may also be subject to access by a provider’s personnel or subprocessors in other countries where legally permitted.

We take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. These measures include appropriate access controls, secure communications, system monitoring and other safeguards suited to the information being processed.

Where a restricted international transfer takes place, we will ensure that an appropriate transfer mechanism or safeguard is in place as required by applicable data protection law. This may include an adequacy decision or appropriate contractual safeguards, depending on the destination and circumstances.

No electronic system can be guaranteed to be completely secure. We take reasonable steps to maintain the security of our services and respond appropriately to security incidents.

We retain personal data only for as long as necessary for the purposes for which it was collected, subject to applicable legal requirements and our contractual obligations.

Our standard retention period for personal data processed through AssistApp is no more than 12 months. Retention is reviewed as part of our annual review process each 1 January. Personal data will be deleted or anonymised when it is no longer required and no later than the applicable 12 month limit, unless a specific legal exception applies.

You can also ask us to delete your personal data at any time, as described in section 13.

Where we process personal data on behalf of a business client, deletion and retention will also be subject to our agreement with that client and its documented instructions.

We may retain particular information beyond the standard period where required by law or where necessary to establish, exercise or defend legal claims. Where this applies, we will retain only the information necessary for that purpose and for the period required.

Information in backups or system logs may not always be deleted immediately from every copy. Any remaining copies will be protected and removed in accordance with our applicable retention and deletion procedures.

Under the UK GDPR, you may have the right to request access to your personal data; request correction of inaccurate or incomplete data; request deletion of your personal data; request restriction of processing in certain circumstances; object to processing based on legitimate interests; request a copy of certain personal data in a portable format, where applicable; and withdraw consent where processing is based on consent.

These rights are subject to applicable legal conditions and exemptions.

If a business using AssistApp controls the information you wish to access or delete, please contact that business in the first instance. AssistApp will support the business in responding to your request where required.

For personal data that AssistApp processes as a data controller, you can contact us using the details in section 18. You can also ask us to delete your personal data, as described in section 13.

You also have the right to complain to the UK Information Commissioner’s Office (ICO) at https://ico.org.uk/.

You can ask us to delete your personal data at any time. This applies to anyone whose data is processed through AssistApp, including customers who message a business on WhatsApp, and you do not need an AssistApp account to make a request.

How to request deletion: email hello@assistapp.me with the subject line “Data Deletion Request”. Please include your name, the telephone number or email address you used when messaging or booking, and, if you know it, the name of the business you were dealing with. We may ask for further information to confirm your identity before acting on a request.

If a business using AssistApp controls your information, you can also ask that business directly. We will assist the business in responding to your request.

We will confirm that we have received your request and complete it within one month, unless the request is complex, in which case we will tell you about any extension and the reason for it. We will delete or anonymise the personal data we hold about you, which may include contact details, message history, booking information and related technical records.

We may keep limited information where the law requires it, or where it is necessary to establish, exercise or defend legal claims. Information in backups or system logs may not be removed immediately; it will be protected and removed in accordance with our retention and deletion procedures.

Business clients who wish to delete their account and associated data can contact us at the same address. Deletion on termination is also governed by our Terms and Conditions and any agreement between us.

Deleting your data from AssistApp does not delete information held by Meta or WhatsApp, which process information under their own terms and privacy policies. See section 5 for links.

If we become aware of a security incident affecting personal data, we will investigate it promptly, take steps to contain it and reduce harm, and notify affected business clients without undue delay. Where the law requires, we will also notify the UK Information Commissioner’s Office (ICO) and affected individuals.

We only disclose personal data to law enforcement or other public authorities where we are legally required to do so. We review each request to check that it is valid and lawful, challenge requests that are unclear or too broad, and disclose only the minimum information needed. Where the law allows, we will tell the relevant business client about the request before disclosing information. We do not give public authorities direct or unrestricted access to personal data.

Our website may use essential technologies required to deliver its functionality, maintain security and support performance.

Where our website uses non essential cookies or similar technologies, we will provide appropriate information and obtain consent where required by law.

You can manage cookies through your browser settings. Disabling certain cookies or technologies may affect some website features.

AssistApp is a business software service and is not specifically designed to collect personal data directly from children for our own purposes.

Businesses using AssistApp are responsible for ensuring that their use of the service is appropriate for their customers, including children where relevant, and that any additional legal requirements and safeguards are met.

We may update this Privacy Policy to reflect changes to our services, technology, service providers or legal obligations.

The latest version will be published on our website, together with the date on which it was last updated.

For questions about this Privacy Policy, our data protection practices or requests relating to personal data for which we are the controller, please contact us.

• Company: Norsey Technologies Limited
• Trading name: AssistApp
• Company number: 17507180
• Registered office: 35 Chapel Court, Billericay, England, CM12 9LX
• Email: hello@assistapp.me
• Website: https://assistapp.me