Privacy Policy
Last updated · Applies to I.ASit, including the pilot
1. Who is who
Two parties are involved, and this policy covers both.
- The company you deal with (“the company”, ) uses I.ASit for its support team. When you write to the company, or you work for it, the company decides why your data is used. Questions about your data: .
- The provider (“we”, ) runs I.ASit and hosts it for the company. We look after the data for the company, and we are responsible for our own company records (accounts, billing and security of the service). Contact: .
2. What information is handled
Staff (agents, supervisors, admins)
- Name, email or username, role, shift times and availability status.
- Your password, stored only in scrambled (hashed) form.
- A record of your actions in the app (for example replying, resolving, escalating, submitting reports) with the time. This is the audit log.
- Reports you write or that the app drafts from your activity, and the review comments on them.
- When you were last signed in.
Customers
- Name and email address.
- Ticket subjects and messages, internal staff notes, ratings and comments left by the customer, and links between a customer's tickets.
- When a customer uses the public complaint form: the message, the type (complaint, question, feedback or idea), and the topic or product they choose. Technical details such as the network address are used briefly in memory to limit spam and are not stored.
- When a customer writes to the company's support mailbox (if connected): the email, its sender and subject, and the replies sent back.
The company account and billing
- Company name, kind of business, country, size, and the admin's name and email.
- The plan, the dates it covers, and a record of each payment: reference, amount, status, how it was paid, and the invoice and receipt we issued. Card and bank details are entered on Paystack's secure page. We never see or store them.
- Requests made on our landing page (company name, contact details, message).
The company's support mailbox
If an admin connects a mailbox, we keep its address, the mail server settings and the app password. The password is stored encrypted and is used only to read new emails and send replies from that address.
On your device
- A sign-in token kept in your browser's local storage so you stay signed in (up to 12 hours), and small settings such as the page you last opened. We do not use advertising or tracking cookies.
Technical logs
When something breaks, the server keeps an error message for about 30 days to help us fix it. Email addresses and long numbers are removed before it is stored.
3. Why it is used
To answer customers, assign and escalate tickets, spot recurring issues, manage shifts and workload, review quality, keep the service secure, take payment and issue invoices and receipts, send service emails (such as setup links, renewal reminders and receipts), and meet record-keeping duties.
4. AI-assisted drafts
If drafting with AI is switched on, the app sends the ticket text, a short list of the customer's earlier tickets (subject, category, status) and selected passages of approved company knowledge to the AI provider ([Owner: confirm the provider, currently Anthropic, and your settings]) so it can write a draft reply. A person reviews and decides before anything is sent. If AI is not switched on, drafts are built inside the app without sending data elsewhere. The AI provider's own terms apply to that processing.
5. Who can see it
- Inside a company. Access depends on role. Supervisors see team activity, reports and feedback. Admins manage accounts, permissions and the audit log. In this pilot version, signed-in staff can read all tickets; role limits apply to pages and actions.
- Between companies. Each company's workspace is kept separate. One company cannot see another's data.
- Our admin console. It shows company names, admin emails, staff names, roles and sign-in times, plans, payments and invoices. It does not show tickets or customers. Our engineers may need to look at a company's data only to fix a problem the company reports, or where the law requires.
6. Sharing, and the services we rely on
We do not sell personal data. We use these providers to run I.ASit, and they handle data only for that purpose:
| Provider | What for |
|---|---|
| Render | Hosting the application |
| Supabase | The database where all data is stored |
| Paystack | Taking payments (card, transfer, USSD). It has its own privacy policy and receives the payer's email, the amount and the company name |
| Email delivery service | Sending setup links, invoices, receipts and reminders ([Owner: name the service you use, for example Gmail relay or Brevo]) |
| AI provider (optional) | Reply drafts, only when switched on |
We may also share data where the law requires it, or to protect people and the service.
7. Security
Passwords are hashed, mailbox passwords are encrypted, sign-in attempts are limited, access is controlled by role, companies are kept apart, connections use HTTPS, and important actions are logged. No system is perfectly secure, so please sign out on shared devices and report anything suspicious. If we find that personal data was exposed, we will tell the affected company without undue delay so it can act.
8. How long it is kept
Data is kept while the company uses I.ASit and while needed for support and record-keeping: [Owner: set the retention period for tickets, for example 24 months]. Invoices and receipts are kept for [Owner: the period your tax law requires]. When a company ends its agreement we delete its workspace after [Owner: number of days, see the Terms] days. The app has no automatic deletion of old tickets yet. To request deletion sooner, contact us.
9. Your rights
Depending on your country's law, you may have the right to see, correct or delete your data, and to object to or limit some uses. A customer should contact the company first (); a company or staff member can also write to us (). [Owner: add the regulator or local law that applies, for example the data protection law of ].
10. Data held in other countries
Our hosting, database, payment, email and AI providers may store or process data in other countries. We choose providers that protect data, and we ask the company to tell its customers about this where the law requires.
11. Children
I.ASit is a workplace tool and is not meant for children.
12. Changes
If this policy changes we will update the date above and tell users in the app or by email.