Privacy policy

1. Who is responsible for your data

We are the controller for the data of people who visit our website, write to our own assistant, create an account, use the dashboard or buy credits.

When a business uses Sales Core AI to talk to its own customers (for example, a shop’s AI salesperson on the shop’s website or WhatsApp), that business is the controller of its customers’ data and we process it on its behalf as a processor, under the data processing terms in our Terms of service. If you wrote to such an agent, please contact that business first; we will help it answer your request.

Contact for any privacy question: [email protected], +30 697 550 9901.

2. What we collect

• Account data: your name, email address, password (stored only as a secure hash), the organizations you create or join and your role in them. Team members can also connect their Telegram account to receive conversations handed over to people.
• Business settings and content you add: your business profile, catalog, prices, knowledge (texts, files and pages of your website we import at your request), agent settings and instructions.
• Sign-in and security data: a session cookie, the IP address and browser of each sign-in, and a log of important account actions.
• Billing data: your credit balance and every charge and credit, and for online purchases the payment’s amount, status and the identifiers Paddle gives us. Card and bank details go to Paddle only; we never see them.
• Conversations with our own assistant on salescoreai.com: your messages and what you choose to tell it — for example your name, email, business name and website when you ask it to create a workspace for you.
• Conversations handled for our customers (as their processor): messages, the contact details people share (name, phone, email), the identifier of the channel they write from (for example a WhatsApp number or a Telegram account), and the bookings, orders and notes created in the conversation.
• Emails we send you (account confirmation, password reset, balance and payment notices) and your replies.

3. Why we use it and on what legal basis

• To provide the service you signed up for — your account, agents, conversations, credits and billing (performance of a contract).
• To keep the service secure and prevent abuse, including checking that free starting credits go to each person only once (our legitimate interest in a safe and fair service).
• To keep accounting and tax records of credits sold and fees charged (legal obligation).
• To answer your questions and send you service messages (contract and legitimate interest). We do not send marketing emails without your consent.
• To improve the service using aggregated statistics about how it is used (legitimate interest).
• Only if you allow advertising cookies: to measure which of our Google ads lead to sign-ups (consent). We do not sell personal data.

4. AI processing

To write a reply, an agent sends the conversation and the relevant business information to an AI model provider (OpenAI or Anthropic, depending on the model the business chose). To search a business’s knowledge, texts are turned into vectors by OpenAI. Providers receive only what is needed for the request, and under their API terms they do not use this data to train their models. We do not train AI models on your conversations.

Agents always tell people they are talking to an AI (EU AI Act, Article 50) and a person from the business can take over a conversation. Agents do not make decisions that have legal or similarly significant effects on you.

5. Who we share data with

We use the following service providers, only for the purposes above and under contracts that protect your data:

• DigitalOcean — hosting of our servers and database (Amsterdam, the Netherlands).
• Zoho — sending our emails (European Union).
• OpenAI and Anthropic — AI models for replies and knowledge search (United States).
• Paddle — our reseller and merchant of record: it processes payments for credits, issues invoices and handles taxes.
• Meta (WhatsApp), Telegram and Google (Calendar) — only when a business connects these services to its agents, to deliver messages or manage bookings.
• Google (Google Ads) — only if you allow advertising cookies on our website or dashboard, to measure which of our ads lead to sign-ups.

We may also disclose data when the law requires it, or to a successor if our business is transferred, in which case this policy continues to apply.

6. Transfers outside the European Economic Area

Our servers are in the European Union. When a provider processes data outside the European Economic Area (for example AI providers in the United States), the transfer is protected by an adequacy decision of the European Commission (such as the EU–U.S. Data Privacy Framework, where the provider is certified) or by the Commission’s Standard Contractual Clauses.

7. How long we keep data

• Account, business content and conversations: for as long as the account exists. A business can ask us to delete its conversations or a specific customer’s data at any time.
• After an account is closed: we delete or anonymise its data without undue delay after the request, except what we must keep by law.
• Billing records: for as long as accounting and tax law requires.
• Sign-in sessions: they expire after 7 days of the session’s start; the security log is kept while the account exists.

8. Your rights

Under the GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to its use, and to receive data you gave us in a portable format. Where we rely on consent, you can withdraw it at any time. Write to [email protected]; we answer within one month.

You also have the right to complain to a data protection authority, in particular [data protection authority].

If you talked to an agent of one of our customers, you can also ask that business directly; when the business asks us, we help it fulfil your request. Writing “stop” or a similar word in a messenger stops follow-up messages from that business’s agent.

9. Cookies and browser storage

We set advertising cookies only with your consent. Everything else is stored because the service needs it to work.

• Google Ads (only if you click “Allow”): Google’s cookies record that you came from one of our ads and whether you signed up, so we can measure our advertising. Until you choose, Google’s tag is not loaded at all. Your choice is kept for 6 months in a cookie (sc_consent) shared by salescoreai.com and app.salescoreai.com; change it at any time with “Cookie settings” at the bottom of the site or in the dashboard.
• Dashboard: a sign-in cookie (aisales_session) and your language choice (lang).
• Website chat: the chat stores a visitor identifier and the current conversation in your browser’s local storage so that a conversation continues when you come back, and remembers in session storage that you closed its invitation.
• Payment page: when you buy credits, Paddle’s checkout may set its own cookies to process the payment and prevent fraud; see Paddle’s privacy notice.

You can also clear these in your browser at any time; you will be signed out, a chat will start over and we will ask about cookies again.

10. Security

All traffic is encrypted (HTTPS). Passwords are stored as hashes, tokens of connected integrations are encrypted, each business can see only its own data, and access to our systems is limited to people who need it. If a breach affects your data, we will inform you and the authority as the law requires.

11. Children

Sales Core AI is a service for businesses and is not intended for children under 16.

12. Changes to this policy

We may update this policy when the service or the law changes. We will publish the new version here with its date, and tell account holders about important changes by email or in the dashboard.