Privacy Policy

1. Introduction

Welcome to impressly, a customer support platform operated by Impressly Inc. ("Company," "we," "us," or "our"). This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you access or use the impressly platform and all associated services (collectively, the "Service").

We are committed to protecting your privacy and handling your data with transparency and care. This policy applies to all users of the Service, including account holders, team members, and visitors who interact with the impressly chat widget. By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

2. Information We Collect

Information You Provide:

• Account data, including your name, email address, and password
• Company or organization name associated with your account
• Communication content, such as chat messages and support conversations
• Knowledge base articles and canned responses you create
• Files you upload to the Service
• Invitation details when you invite team members, including their email address and assigned role

Information Collected Automatically:

• IP address, used for rate limiting and security purposes
• Device and browser information
• Usage data, including pages visited and features used within the Service
• WebSocket connection data necessary for real-time messaging functionality

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide, operate, and maintain the Service
• Process messages and conversations between your team and your customers
• Power AI-assisted auto-responses to improve response times for visitor inquiries
• Send email notifications, including conversation transcripts and agent alerts
• Improve the quality, performance, and reliability of the Service
• Detect, prevent, and address security threats and fraudulent activity
• Comply with legal obligations and enforce our Terms and Conditions

4. AI and Automated Processing

We use AI and large language model (LLM) technology to provide automated responses to visitor inquiries through the impressly chat widget. When a visitor sends a message, it may be processed by our AI systems to generate a suggested response.

Each AI-generated response includes a confidence score. Responses that fall below our confidence threshold are automatically flagged for human review by your support team before being sent to the visitor. This ensures that customers receive accurate and helpful information.

AI processing metadata, including the model used and confidence scores, is stored alongside messages for transparency and quality assurance purposes.

Studio and the coding agent. When you use Studio, our done-for-you engineering service, or the Autopilot coding agent, AI models process your Studio requests, the requirements interview, files you attach to Studio requests or interview messages, the source code of the repositories you connect, and the error reports, issue comments and support conversation excerpts the coding agent investigates, so that we can scope, investigate, build and review the work you ask for. The AI providers that receive this data, and what each one receives, are listed in section 5.

5. Data Sharing and Third Parties

We may share your information with third parties only in the following circumstances:

Service Providers:

We use the following service providers to operate the Service. Each one receives only the data needed for the purpose listed:

• Anthropic: AI models that run our coding agents in Studio and Autopilot, which scope, investigate, implement and review the work you request. Receives: Source code from repositories you connect to Studio or the coding agent; Studio requests, interview transcripts and summaries, accepted scopes and acceptance criteria; Files attached to Studio requests; Error reports, issue tracker comments and support conversation excerpts that the coding agent investigates.
• Z.ai (Zhipu AI): AI model that conducts the Studio requirements interview. Receives: Studio interview messages; Files and images attached to Studio interview messages.
• OpenAI: AI models that answer visitor questions in the chat widget and screen visitor messages for abuse. Receives: Visitor chat messages, conversation history and images visitors attach; Knowledge base content used to answer questions; Information returned by integrations you enable for the assistant.
• Amazon Web Services: File storage and encrypted database backups (Amazon S3) and email delivery (Amazon SES). Receives: Files uploaded to the Service; Encrypted copies of our application database; Email addresses and the content of emails we send and receive.
• OVHcloud: Hosting of our application servers and databases. Receives: All data stored in the Service.
• Cloudflare: Hosting and delivery of our website and web application. Receives: Web requests to our website and web application, including IP addresses.
• Stripe: Payment processing. Receives: Billing contact details and payment information; Purchase, subscription and refund records.
• Sentry: Error monitoring for our application and background services. Receives: Error reports, which can include account and request identifiers and fragments of the data being processed when an error occurred.
• Better Stack: Uptime monitoring, scheduled job monitoring and on-call alerts for our team. Receives: Service health checks and alert summaries, which can include account and request identifiers.
• PostHog: Product analytics on our website and web application, when enabled. Receives: Page views and product events without message content; Anonymous visitor identifiers.

Integrations:

When you connect a third-party platform to impressly, we store the encrypted access token and domain required to enable the integration. Data shared with that platform is governed by its own privacy policy.

Legal Requirements:

We may disclose your information if required to do so by law, court order, or in response to a valid request from a law enforcement authority.

Business Transfers:

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

We do NOT sell your personal information to any third party.

6. Data Retention

We retain your information in accordance with the following practices:

• Account data is retained for as long as your account remains active
• Conversation data is retained in accordance with your account settings
• When the account owner deletes the account from Settings, the account enters a 14-day grace period (the deletion can be canceled during it); after that, the account and its data are permanently deleted
• A deleted project can be restored for 30 days; after that it is permanently deleted with its conversations, visitors and knowledge base
• Encrypted database backups are kept for 30 days, so copies of deleted data may remain in backups for up to 30 days after deletion

7. Data Security

We implement a variety of technical and organizational measures to protect your personal information, including:

• Password Protection: All passwords are hashed using bcrypt and are never stored in plain text
• Authentication: JWT-based authentication with token expiration and a token denylist for revoked sessions
• Encrypted Credentials: Sensitive credentials, such as third-party access tokens, are stored using encrypted storage
• Rate Limiting: Request limits are enforced globally, on authentication attempts, and on widget requests to prevent abuse
• Encryption in Transit: All data transmitted between your browser and our servers is encrypted via HTTPS
• Access Controls: Account-level actions (inviting and removing team members, changing account settings and exporting account data) are limited to owners and admins, and deleting the account is limited to the owner. All team members of an account can access that account's projects and conversations

8. Your Rights

Depending on your location, you may have certain rights regarding your personal information:

GDPR (European Union / European Economic Area):

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time

CCPA (California, United States):

• Right to know what personal information is collected, used, and shared
• Right to delete your personal information
• Right to correct inaccurate personal information
• Right to opt-out of the sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising your privacy rights

How to Exercise Your Rights:

You can export your account data and delete your account yourself from Settings in the app. To exercise any other right described above, please contact us at support@impressly.online. We will respond to your request within 30 days.

9. Cookies and Local Storage

We use browser storage to maintain your authenticated session in the Service. We do not use traditional third-party tracking cookies for advertising.

On the public marketing site (impressly.online), we may use PostHog to measure page views and conversion events on landing and comparison pages (for example, which call-to-action was clicked). PostHog is loaded only when a project key is configured in our hosting environment. It may set a first-party cookie or similar identifier to distinguish anonymous visitors. We do not use advertising pixels and we do not sell this data. See PostHog's privacy policy .

The application (app.impressly.online) may also use PostHog, loaded only when a project key is configured, to measure product events (for example, that a checkout started or completed). These events contain no message content or visitor data — only event names and coarse properties like plan codes. We do not use advertising pixels in the application. IP addresses are tracked solely for rate limiting and security purposes as described in the Data Security section above.

10. Children's Privacy

The Service is not directed to children under the age of 16, and we do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at support@impressly.online so that we can take appropriate action to delete such information.

11. International Data Transfers

Your information may be transferred to and processed in the United States and in the other countries where we and the service providers listed in section 5 operate. If you are accessing the Service from outside those countries, please be aware that your data may be subject to the laws of the countries where it is processed, which may differ from the laws of your jurisdiction.

For transfers of personal data from the European Union or European Economic Area, we implement appropriate safeguards, including Standard Contractual Clauses approved by the European Commission, to ensure your data is protected in accordance with applicable data protection laws.

12. Changes to This Policy

We reserve the right to update or modify this Privacy Policy at any time. When we make changes, we will update the "Effective Date" at the top of this page and notify you via email or through a notice within the Service.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. For material changes, we will provide at least 30 days' notice before the changes take effect. If you do not agree with the updated policy, you should discontinue your use of the Service.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: support@impressly.online

Company: Impressly Inc.