Privacy policy

Who we are

SmartSite Assistant is a product of Prisma, obrt za IKT usluge, vl. Marko Malec, a sole proprietorship (obrt) registered in Croatia, OIB 78332077299, Ulica Braće Domany 4, 10000 Zagreb, Croatia, Croatia.

For any privacy question or request, email privacy@smartsiteassistant.com.

Our role

We are the controller for the personal data of people who visit this website and of the people who use the dashboard (agency staff and business users).

When a business uses SmartSite Assistant to talk with its own customers, that business (or the agency that manages it) decides why and how its customers' data is processed. For that data we act as a processor: we process it only on their instructions and to provide the service. If you chatted with a business, please contact that business first; we will help them with your request.

What we collect

• Website visitors: this website sets no cookies and uses no analytics or advertising trackers. Our hosting provider processes technical data such as your IP address and browser type to deliver the pages and protect them against abuse.
• Dashboard users: name, email address, password (stored only as a secure hash), language and display preferences, the agencies and projects you belong to and your role, the time and IP address of sign-in attempts, and a log of important changes you make (for example, connecting WhatsApp).
• Account security: when you use two-factor authentication, the key of your authenticator app (stored encrypted), your recovery codes (stored only as hashes) and, for passkeys, only their public keys. Fingerprint, face and screen-lock data stay on your device and never reach us. We also keep a sign-in history (time, browser, operating system and a partly hidden IP address, such as 84.241.x.x) and the devices you chose to stay signed in on, so you can review them in your account.
• Business content: the website pages and files a business adds as knowledge, the assistant's instructions and settings, and the actions it may take.
• Conversations with a business's customers: messages sent in the website chat, the page they were sent from and an anonymous visitor key; on WhatsApp, the customer's phone number and WhatsApp profile name, the messages (including photos and voice messages), their delivery and read status, and, when a conversation starts from an ad on Facebook or Instagram, the ad details Meta includes (such as the ad ID and headline).
• Details a customer gives the assistant on purpose, such as a name or email address for a quote request, are passed on to the business in the way the business has set up.

Data we receive from Meta (WhatsApp Business Platform)

When a business connects WhatsApp through Meta's own signup flow (Facebook Login for Business and WhatsApp Embedded Signup), Meta gives us access to the WhatsApp Business Account the business chooses to share. We receive and store: the WhatsApp Business Account ID, the phone number ID, the phone number and its verified business name, its quality rating, the business's message templates, and an access token, which we store encrypted.

Through the same connection we receive the WhatsApp messages customers send to the business and the status of messages sent to them, as described above.

We use this data only to provide the service the business asked for: receiving and answering WhatsApp messages, sending the messages and templates the business chooses to send, showing delivery status, and creating and managing the business's message templates.

We do not sell this data, do not use it for advertising or profiling, and do not share it with anyone other than the service providers listed below that we need to run the service.

A business can disconnect WhatsApp at any time under Messaging apps in the dashboard. We then delete the access token right away and stop receiving the number's messages.

How we use personal data and on what basis

• To provide the service: running the assistants, showing conversations, sending and receiving messages, and sending account emails such as invitations, password resets and security alerts. Basis: performance of a contract (Article 6(1)(b) GDPR) and, for data we process for businesses, their instructions.
• To keep the service secure and prevent abuse: sign-in protection, two-factor authentication, alerts about important changes to your account, rate limits and logs. Basis: our legitimate interest in a safe service (Article 6(1)(f) GDPR).
• To meet legal obligations, such as keeping accounting records. Basis: legal obligation (Article 6(1)(c) GDPR).

We do not use personal data for advertising, we do not sell it, and we do not use it to train AI models.

Artificial intelligence

Answers are generated by OpenAI's models. To answer a message, we send the conversation, the relevant knowledge of the business and the assistant's instructions to OpenAI. Photos customers send may be analyzed and voice messages transcribed for the same purpose.

Under OpenAI's terms for its API, this data is not used to train OpenAI's models. OpenAI may keep it for a limited period (up to 30 days) to detect abuse.

AI answers can contain mistakes. Each business decides what its assistant may say and do.

Who processes data for us

We use these service providers (sub-processors), each bound by a data processing agreement:

• OVHcloud: the server that runs this website, the dashboard, the database, background tasks and file storage, and its backups (Frankfurt, Germany).
• Cloudflare: domain name services and the relay that forwards Meta's WhatsApp notifications to us.
• Meta Platforms: the WhatsApp Business Platform (Cloud API), when a business connects WhatsApp.
• OpenAI: generating answers, analyzing photos and transcribing voice messages (United States).
• Resend: sending account emails and the emails businesses set up (United States).

International transfers

We store data in the European Union, on our server in Frankfurt (Germany). Some of the providers above are based in the United States. Transfers to them are covered by the EU–US Data Privacy Framework where the provider is certified under it, and otherwise by the European Commission's standard contractual clauses.

How long we keep data

• Account data: as long as the account exists. When an account is deleted, we delete its data within 30 days, except what the law requires us to keep.
• Conversations and business content: as long as the business or its agency keeps them. They are deleted when the business deletes them or its project, or when the agency's account is closed.
• WhatsApp access tokens: until the business disconnects WhatsApp.
• Your sign-in history: 90 days. Remembered devices: until their 30 days end or you remove them; the record of a device is deleted 400 days after its last use.
• Security logs, such as sign-in attempts: for a limited period, after which they are removed.
• Backups: at most 30 days.

Your rights

You can ask us to access, correct or delete your personal data, to restrict or object to its processing, or to receive it in a portable format. Email privacy@smartsiteassistant.com. We answer within one month.

If we process your data for a business (for example, because you chatted with it), we pass your request on to that business and help it respond.

You can also complain to a data protection authority: in Croatia, the Personal Data Protection Agency (AZOP, azop.hr), or the authority where you live, such as the Dutch Autoriteit Persoonsgegevens.

Deleting your data

Our data deletion page explains how to have your data deleted, including the data we receive through WhatsApp.

Security

We protect data with encrypted connections (HTTPS), encryption of stored credentials such as access tokens and API keys (AES-256-GCM), passwords stored only as secure hashes (Argon2id), two-factor authentication with an authenticator app or a passkey, strict access control per agency and project, and a log of important changes. When you choose a new password, we check it against passwords known from data leaks: only the first 5 characters of a hash of your password are sent to the Have I Been Pwned service, never the password itself.

Cookies and local storage

This website uses no cookies. The dashboard uses only cookies it needs to work: your sign-in session, a device cookie that keeps you signed in when you choose “Remember me” and recognizes a new device at sign-in, short-lived cookies during sign-in (at most 10 minutes), your language, and the last agency and project you used.

The website chat on a business's site stores an anonymous visitor key and the chat history in the visitor's browser, so a conversation continues after the page reloads.

Children

SmartSite Assistant is a service for businesses and is not directed at children under 16.

Changes

We may update this policy. The date at the top shows the current version. We inform dashboard users of important changes in advance.

Contact

Prisma, obrt za IKT usluge, vl. Marko Malec, Ulica Braće Domany 4, 10000 Zagreb, Croatia, Croatia. Email: privacy@smartsiteassistant.com.