Cookies on this site

We use the cookies the site needs to work. With your consent we also remember which page or link first brought you here, so we know where the businesses who sign up come from. We do not use advertising or third-party tracking cookies. You can change your choice at any time with “Cookie settings” at the foot of the page. Read the cookie statement

Assistant Workshop
Sign in
Theme

Draft

A lawyer has not reviewed this text yet, and the fields in square brackets are still to be filled. It is published so you can read what the service will offer; it is not yet in force as written.

Privacy Policy

Version 2026-10-05

Template. This policy is a template prepared for the Assistant Workshop service. It is not legal advice. Before it is used in production, the operator must have it reviewed by a qualified lawyer and complete every field in square brackets.

1. Who we are

[Legal name of the operator], [registered address], [registration number] ("we") operates Assistant Workshop. For the personal data this policy describes we are the controller. You can reach us at [e-mail for privacy requests]. [Data protection officer, if appointed.]

2. What this policy covers

This policy covers the people who use the cabinet (business owners and their staff) and the visitors of our website. It does not cover the customers who write to or call a business's assistant: for their data the business is the controller and we process it on its behalf under the data processing agreement (DPA); the business's own privacy notice tells them how it is handled.

3. What we collect

  • Account: your phone number or e-mail address, your name if you give it, your language and country, the businesses you belong to and your role.
  • Sign-in and security: one-time codes (only a hash, for at most a day), your sessions with their device (browser) and IP address, authenticator settings and recovery codes (only hashes), and the security log of your sign-ins and sensitive actions.
  • Use of the cabinet: the steps you take to set up and run your assistant, page performance measurements without personal content, and where you first came from (the address or campaign that brought you, kept with a new account).
  • Notifications: the addresses, Telegram chats and devices where you chose to receive notifications, and your quiet hours.
  • Billing: the business's legal name, tax number and address, invoices and payment status. Card details are handled by the payment provider; we never see them.
  • Support: what you write to us and our answers.

4. Why we use it and on what legal basis

  • To provide the service you signed up for: your account, sign-in, notifications, billing (performance of a contract).
  • To keep the service and your account secure: limits on sign-in attempts, bot checks, the security log, fraud prevention (legitimate interests and legal obligations).
  • To improve the product: aggregated measurements of how the cabinet is used and how fast it is (legitimate interests).
  • To keep invoices and accounting records (legal obligation).
  • To tell you about changes to the service, its terms and its sub-processors (performance of a contract and legal obligation).

We do not sell your data, do not use it for advertising and do not use it to train AI models.

5. Who receives it

Our sub-processors (hosting, e-mail and SMS delivery, the bot check, payments, error monitoring) receive only what they need to do their job. The full list with purposes and locations is in section 8 of the DPA and at /v1/legal/subprocessors; we announce changes in advance. We disclose data to authorities only where the law requires it.

6. Where it is kept

The service and its database run in the European Union (Frankfurt, Germany). Where a sub-processor processes data outside the European Economic Area, the transfer relies on an adequacy decision or the EU Standard Contractual Clauses. [Transfer mechanisms to be confirmed per sub-processor.]

7. How long we keep it

  • Account data: while your account exists, and then as long as needed for the purposes above or the law. [Retention after the account is closed.]
  • Sessions: up to 30 days (a day for platform administrators); a session unused for a week ends earlier.
  • One-time sign-in codes: at most one day.
  • Page performance measurements: 90 days.
  • Invoices and payment records: as long as tax law requires.
  • Encrypted backups: up to [12] months.

8. Your rights

You can ask for access to your data, its correction or deletion, the restriction of its processing, a copy in a portable format, and you can object to processing based on legitimate interests. Write to [e-mail for privacy requests]; we answer within one month. You can also complain to your data protection authority (in Georgia, the Personal Data Protection Service; in the EU, the authority of your country).

9. Security

Traffic is encrypted (TLS), secrets are stored encrypted, each business's data is separated in the database, sign-in uses one-time codes with an optional authenticator, and access to personal data is recorded in an audit log.

10. Cookies

The cabinet uses only the cookies it needs to work and to remember your choices. They are listed in the cookie statement.

11. Changes to this policy

We publish a new version with the day it takes effect and show it on the sign-in page. Earlier versions stay available.

12. Contact

[Legal name of the operator], [registered address], [e-mail for privacy requests].

Privacy Policy · Assistant Workshop