Privacy policy

AutoChat is a communications platform built and operated by Autograf Digital (“AutoChat”, “we”, “us”), based in Calgary, Alberta, Canada. Agencies, software companies and developers (“partners”) use AutoChat to run voice, messaging, email, calendar, CRM, commerce and team collaboration inside products they own and brand, for the businesses they serve (“clients”).

This policy explains what personal information we handle, why, who we share it with, how long we keep it, and the choices and rights you have. It applies to this website, to partner accounts, and to the information AutoChat processes when a business uses a product built on it.

When we process information on behalf of partners and their clients

Most of the personal information in AutoChat belongs to the customers of the businesses our partners serve: the people who call, text, email, book or pay those businesses (“end customers”). For that information, AutoChat acts as a service provider (processor). We process it only on the instructions of the partner and its client, only to provide the functionality they have set up, and under a written agreement with the partner. The partner and its client decide what to collect and why, and they are responsible for their relationship with their customers, including notice and consent.

If you are an end customer and want to know what a business holds about you, or want it corrected or deleted, contact that business. You can also contact us and we will pass your request on and help them act on it. See Data deletion.

When we decide how information is used

We are responsible (a controller) for information about partners and their staff who hold AutoChat accounts, for visitors to this website, and for people who contact us or apply for access.

From partners and their staff

• Account details: name, work email, phone number, role, and the workspace and clients you have access to.
• Business and billing details: company name, billing contact, and records of the services used.
• Activity and security records: sign-ins, actions taken in the product, and audit logs.

On behalf of partners and their clients (end-customer data)

• Contact identifiers: names, phone numbers, email addresses and social media handles.
• Communications: the content and metadata of calls, text and rich messages, social messages and emails sent or received through AutoChat.
• Call recordings and transcripts, where a business has turned these on.
• Bookings and calendar events, forms and survey responses, pipeline and notes.
• Commerce records: products, estimates, invoices, contracts and payment status. Card details are handled by our payment processors, not stored by AutoChat.
• Consent records: opt-ins, opt-outs, STOP replies, bounces and complaints, with when and how each happened.
• Documents, images and files exchanged with the business.
• Website visitor behaviour on sites run by the business, where the business has enabled analytics.

From visitors to this website

• What you submit through our forms (for example, a request for access or a message).
• Basic technical information our hosting provider logs to deliver and protect the site, such as IP address and browser type.

This website does not use advertising cookies or third-party tracking pixels.

• To provide AutoChat: to route, send, receive, thread, store, search and display communications and records for the business they belong to.
• To check consent before messages are sent, and to honour opt-outs.
• To run AI features a business has turned on, such as an AI receptionist, transcription, summaries and suggested replies, for that business only.
• To measure usage per business, so partners can be billed and can bill their clients.
• To secure the service: to prevent abuse, fraud and spam, and to investigate incidents.
• To support partners and respond to requests.
• To review applications and reply to messages sent through this website.
• To meet legal obligations.

We do not sell personal information. We do not use end-customer data for our own marketing, and we do not use it to build profiles for advertising.

A business can choose to connect a Google account to AutoChat. When it does, AutoChat requests only the access needed for the feature being connected:

• Google Calendar: to read availability and to create, update and cancel events, so bookings made through AutoChat stay in sync with the calendar the business already uses.
• Google Business Profile: to show the business’s reviews in AutoChat and to let the business reply to them.

Information received from Google APIs is used only to provide or improve those user-facing features for the business that connected the account. It is not sold, not used for advertising, not used to train generalized AI or machine-learning models, and not read by people except with the business’s permission, where necessary for security, or to comply with the law. It is not transferred to others except as needed to provide the feature, to comply with the law, or as part of a merger or acquisition with notice.

AutoChat’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

A business can disconnect Google at any time from AutoChat or from its Google Account’s third-party access settings. When it disconnects, we stop accessing that account and delete the tokens we held for it.

A business can connect its Facebook Page, Instagram professional account or WhatsApp Business account. AutoChat uses that access to receive and send messages on the business’s behalf, to show those conversations on each person’s thread, and, where the business uses it, to manage comments and publish posts it schedules.

Data received from Meta platforms is used only to provide those features to the business that connected the account. It is not sold, not used for advertising, not used to build profiles of people, and not shared except with the service providers we need to operate AutoChat. A business can disconnect at any time. Anyone can ask for their data to be deleted using our data deletion instructions.

Some AutoChat features use AI models, for example to answer calls, transcribe them, summarize a conversation or draft a reply. These features run only for businesses that turn them on, use only that business’s information, and are delivered through AI service providers under contracts that prohibit them from using the data to train their own models.

Businesses using AI calling or messaging features are responsible for telling their customers where the law requires it, for example that a call may be recorded or answered by an automated assistant.

We share information with service providers only as needed to run AutoChat, under contracts that require them to protect it. By category:

Cloud hosting and databases

Where the application runs and where data is stored.

Telephony and messaging carriers

Phone numbers, calls, text and rich messages.

Social and messaging platforms

Messaging channels a business connects, such as Meta platforms.

Email delivery and mailbox hosting

Sending, receiving and hosting business email.

Speech recognition

Live and post-call transcription.

AI model providers

AI receptionist, summaries and assisted replies.

Payment processing

Online and in-person payments, and billing.

Calendar and meeting integrations

Calendar sync and meeting links a business connects.

Workflow, monitoring and security tools

Scheduled jobs, error reporting and abuse prevention.

A current list of subprocessors is available to partners on request at [email protected]. We may also disclose information where the law requires it, or to protect the rights, safety and security of people and the service.

AutoChat is operated from Canada. Information may be stored and processed in Canada and in other countries, including the United States, where our service providers operate. When information is processed outside Canada, it is protected by contract, but it may be accessible to courts, law enforcement and national security authorities under the laws of those countries.

• End-customer data is kept for as long as the partner and its client keep their AutoChat account, or until they delete it.
• When a partner’s agreement ends, we give them a reasonable period to export their data, then delete it.
• Account and billing records are kept as long as needed for the relationship and for our legal, tax and accounting obligations.
• Messages sent through this website are kept as long as needed to respond and to keep a record of the conversation.
• A minimal opt-out record (the address or number, the channel and the date) may be kept after deletion so that a person who asked not to be contacted is not contacted again.
• Deleted data is removed from backups as those backups expire on their normal cycle.

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information. These include encryption in transit, data scoped to each business so that one business cannot see another’s records, role-based access for staff, and records of consent changes. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify affected partners, individuals and regulators as the law requires.

Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial law, you can ask to access the personal information we hold about you, ask us to correct it, and withdraw consent (subject to legal or contractual limits). We respond within 30 days, and we may need to confirm your identity first.

If your information is held on behalf of a business, we will direct your request to that business and help it respond. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.

AutoChat is designed around Canada’s Anti-Spam Legislation (CASL). Consent is checked before every message is sent, and every opt-in and opt-out is recorded with when and how it happened. A person who replies STOP to one business is opted out of that business, not every business on the platform.

Partners and their clients are responsible for obtaining the consent CASL and other laws require before sending commercial messages, and for identifying themselves and including an unsubscribe mechanism. We send our own commercial messages only with your consent, and every one includes a way to unsubscribe.

AutoChat is a business service and is not directed at children. We do not knowingly collect information from children for our own purposes.

We will update this policy as AutoChat changes. If a change is significant, we will tell partners before it takes effect. The date at the top shows when it was last updated.

For privacy questions or requests, contact our privacy officer at [email protected] or use our contact form.

Autograf Digital, attention: Privacy Officer, Calgary, Alberta, Canada.