Privacy Policy

1. Introduction

Welcome to impressly, a customer support platform operated by Impressly Inc. ("Company," "we," "us," or "our"). This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you access or use the impressly platform and all associated services (collectively, the "Service").

We are committed to protecting your privacy and handling your data with transparency and care. This policy applies to all users of the Service, including account holders, team members, and visitors who interact with the impressly chat widget. By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

2. Information We Collect

Information You Provide:

• Account data, including your name, email address, and password
• Company or organization name associated with your account
• Communication content, such as chat messages and support conversations
• Knowledge base articles and canned responses you create
• Files you upload to the Service
• Invitation details when you invite team members, including their email address and assigned role

Information Collected Automatically:

• IP address, used for rate limiting and security purposes
• Device and browser information
• Usage data, including pages visited and features used within the Service
• WebSocket connection data necessary for real-time messaging functionality

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide, operate, and maintain the Service
• Process messages and conversations between your team and your customers
• Power AI-assisted auto-responses to improve response times for visitor inquiries
• Send email notifications, including conversation transcripts and agent alerts
• Improve the quality, performance, and reliability of the Service
• Detect, prevent, and address security threats and fraudulent activity
• Comply with legal obligations and enforce our Terms and Conditions

4. AI and Automated Processing

We use AI and large language model (LLM) technology to provide automated responses to visitor inquiries through the impressly chat widget. When a visitor sends a message, it may be processed by our AI systems to generate a suggested response.

Each AI-generated response includes a confidence score. Responses that fall below our confidence threshold are automatically flagged for human review by your support team before being sent to the visitor. This ensures that customers receive accurate and helpful information.

AI processing metadata, including the model used and confidence scores, is stored alongside messages for transparency and quality assurance purposes.

5. Data Sharing and Third Parties

We may share your information with third parties only in the following circumstances:

Service Providers:

• Cloud hosting and file storage providers
• AI and LLM service providers for processing automated responses
• Email delivery services for sending notifications and conversation transcripts
• Background job processing infrastructure (Redis and Solid Queue)

Integrations:

When you connect a third-party platform to impressly, we store the encrypted access token and domain required to enable the integration. Data shared with that platform is governed by its own privacy policy.

Legal Requirements:

We may disclose your information if required to do so by law, court order, or in response to a valid request from a law enforcement authority.

Business Transfers:

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

We do NOT sell your personal information to any third party.

6. Data Retention

We retain your information in accordance with the following practices:

• Account data is retained for as long as your account remains active
• Conversation data is retained in accordance with your account settings
• Upon receiving an account deletion request, your data will be deleted within 30 days
• Backups may retain copies of your data for up to 90 days after deletion

7. Data Security

We implement a variety of technical and organizational measures to protect your personal information, including:

• Password Protection: All passwords are hashed using bcrypt and are never stored in plain text
• Authentication: JWT-based authentication with token expiration and a token denylist for revoked sessions
• Encrypted Credentials: Sensitive credentials, such as third-party access tokens, are stored using encrypted storage
• Rate Limiting: Request limits are enforced globally, on authentication attempts, and on widget requests to prevent abuse
• Encryption in Transit: All data transmitted between your browser and our servers is encrypted via HTTPS
• Access Controls: Role-based permissions (owner, admin, and member) ensure that users only access the data and features appropriate to their role

8. Your Rights

Depending on your location, you may have certain rights regarding your personal information:

GDPR (European Union / European Economic Area):

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time

CCPA (California, United States):

• Right to know what personal information is collected, used, and shared
• Right to delete your personal information
• Right to correct inaccurate personal information
• Right to opt-out of the sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising your privacy rights

How to Exercise Your Rights:

To exercise any of the rights described above, please contact us at support@impressly.online. We will respond to your request within 30 days.

9. Cookies and Local Storage

We use browser storage to maintain your authenticated session in the Service. We do not use traditional third-party tracking cookies for advertising.

We do not use third-party analytics trackers. IP addresses are tracked solely for rate limiting and security purposes as described in the Data Security section above.

10. Children's Privacy

The Service is not directed to children under the age of 16, and we do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at support@impressly.online so that we can take appropriate action to delete such information.

11. International Data Transfers

Your information may be transferred to and processed in the United States, where our servers and service providers are located. If you are accessing the Service from outside the United States, please be aware that your data may be subject to U.S. laws, which may differ from the laws of your jurisdiction.

For transfers of personal data from the European Union or European Economic Area, we implement appropriate safeguards, including Standard Contractual Clauses approved by the European Commission, to ensure your data is protected in accordance with applicable data protection laws.

12. Changes to This Policy

We reserve the right to update or modify this Privacy Policy at any time. When we make changes, we will update the "Effective Date" at the top of this page and notify you via email or through a notice within the Service.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. For material changes, we will provide at least 30 days' notice before the changes take effect. If you do not agree with the updated policy, you should discontinue your use of the Service.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: support@impressly.online

Company: Impressly Inc.