Privacy Policy

1. Introduction

PalySales Inc. ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, password
• Business Information: Store name, business address, business category
• Payment Information: Billing address, payment method details (processed by third-party payment providers)
• Content: Product listings, knowledge documents, AI training data you upload
• AI Image Data: Reference images uploaded for AI image generation, AI-generated images stored in your Media Library, and AI image generation prompts and settings
• Communications: Messages and support requests you send us

2.2 Information Collected Automatically

• Device Information: IP address, browser type, operating system
• Usage Data: Pages visited, features used, time spent on the platform
• Log Data: Error reports, system activity, timestamps
• Cookies: Session cookies, preference cookies (see our Cookie Policy)

2.3 Information from Third Parties

• Social Login: Profile information from Google when you sign in with Google
• Messaging Platforms: Messages received via WhatsApp and Instagram (for your store's chat)
• Payment Providers: Transaction confirmations from Stripe, Paystack, Flutterwave

3. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Power AI-assisted customer support and sales automation
• Generate product images, hero banners, and marketing assets based on your prompts and reference images
• Auto-generate store policies and FAQ documents
• Store AI-generated content in your Media Library
• Send technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze usage patterns and trends
• Detect, investigate, and prevent fraudulent transactions and abuse
• Personalize and improve your experience
• Comply with legal obligations

4. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your data under the following legal bases:

• Contract: Processing necessary to fulfill our agreement with you (e.g., providing the Service)
• Consent: Where you have given explicit consent (e.g., marketing communications)
• Legitimate Interests: Processing necessary for our legitimate business interests (e.g., fraud prevention, improving our services)
• Legal Obligation: Processing required to comply with the law (e.g., tax records)

5. Your Privacy Rights

5.1 General Rights (All Users)

• Access and download your data through your account settings
• Update or correct your personal information
• Delete your account and associated data
• Opt out of marketing communications

5.2 GDPR Rights (EEA/UK Users)

To exercise these rights, email us at privacy@palysales.com or use the self-service tools in your account settings. We will respond within 30 days (or 1 month for GDPR requests).

5.3 CCPA Rights (California Residents)

• Know what personal information we collect and how it's used
• Request deletion of your personal information
• Opt-out of the sale of personal information (we do not sell your data)
• Non-discrimination for exercising your privacy rights

5.4 NDPR Rights (Nigeria)

Nigerian users have rights to access, rectify, and object to processing under the Nigeria Data Protection Regulation (NDPR). Contact us at privacy@palysales.com.

6. Data Sharing and Disclosure

We may share your information with:

• Service Providers: Third parties who help us operate our platform (see our Data Processing Agreement)
• Payment Processors: To process your transactions securely
• AI Providers: OpenAI to power our AI assistant features
• Messaging Platforms: Meta (WhatsApp, Instagram) to enable messaging
• Legal Requirements: When required by law, court order, or government request
• Business Transfers: In connection with a merger, acquisition, or sale of assets

We do not sell your personal information to third parties.

7. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) for transfers from the EEA/UK
• Data Privacy Framework certification where applicable
• Binding Corporate Rules where appropriate

8. Data Retention

We retain your data as follows:

• Account Data: For the duration of your account. After cancellation: full access until billing period ends, then a 14-day read-only grace period, followed by permanent deletion 30 days after cancellation
• Transaction Records: 7 years (for legal/tax compliance)
• Chat Messages: 2 years, or as configured in your settings
• Analytics Data: Aggregated and anonymized after 2 years
• Support Tickets: 3 years for quality and training purposes

9. Data Security

We implement industry-standard security measures:

• TLS 1.3 encryption for data in transit
• AES-256 encryption for data at rest
• Multi-factor authentication options
• Regular security audits and penetration testing
• Role-based access controls
• 24/7 monitoring for security threats

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

10. Cookies and Tracking

We use cookies and similar technologies for:

• Essential: Login sessions, security, basic functionality (cannot be disabled)
• Analytics: Understanding how you use our platform (with consent)
• Marketing: Tracking campaign effectiveness (with consent)

You can manage cookie preferences through our cookie consent banner or your browser settings.

11. AI and Automated Processing

Our AI features process customer messages to provide automated responses. We want you to know:

11.1 Text Processing

• Text messages are sent to OpenAI for processing to generate responses
• We do not use your data to train AI models beyond improving your specific store's responses
• You can disable AI auto-reply at any time in your settings

11.2 Voice Message Processing

• Voice messages are transcribed using OpenAI Whisper
• Audio data is processed in real-time and not stored after transcription
• Transcriptions are treated the same as text messages

11.3 Image Processing

• Customer images are analyzed using OpenAI GPT-4 Vision for product matching
• Product images may generate embeddings for visual search functionality
• Images are processed to provide relevant product recommendations

11.4 Your Rights

Under GDPR Article 22, you have the right not to be subject to decisions based solely on automated processing. Contact us if you have concerns about AI processing of your customers' data.

12. API and Webhook Data

If you use our API or webhook features:

• API Keys: API keys are hashed and stored securely. The full key is only shown once upon creation.
• Webhook Data: When you configure webhooks, we send event data to your specified endpoints. You are responsible for securing those endpoints.
• External Messages: Messages received via API are processed the same as messages from other channels.
• Logging: API requests are logged for security and debugging purposes and retained for 30 days.

13. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email and/or a prominent notice on our platform at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance.

15. Data Protection Officer

For GDPR-related inquiries, you may contact our Data Protection Officer:

16. Contact Us

For questions or concerns about this Privacy Policy or our data practices: