Privacy Policy

This policy explains what personal data Po handles, why, and the choices you have. It covers two groups: account users (business owners and teammates who sign in) and end customers (the people in the conversations a business brings into Po).

1. Roles

• For account users, Po is the controller of account data (name, email, sign-in records).
• For Customer Data, the business using Po is the controller and Po acts as its processor, following the business's instructions.

2. What we process

• Account data: name, email, password (stored only as a secure hash by our authentication provider), role, activity log entries.
• Customer Data: customer names, phone numbers, emails, companies, tags and custom fields; messages imported or received; deals, quotes, invoices, bookings, promises, tasks and notes.
• Technical data: security and error logs needed to keep Po safe. We do not use advertising trackers.

3. Why we process it

• To provide Po: build customer records, detect leaks, prepare and log messages, show reports.
• To keep Po secure: access control, fraud and abuse prevention, the activity log.
• To communicate about your account and important changes.

We never sell personal data and never use Customer Data to train AI models.

4. AI providers

AI drafting is off until a business switches it on. When it is on, the text needed for a draft (recent messages and the business's knowledge base) is sent to the AI provider listed on our subprocessors page, under terms that do not allow them to train on it.

5. WhatsApp

When a business connects the WhatsApp Business API, messages are exchanged through Meta. Customers who reply “STOP” or who are marked as opted out are not sent follow-ups or campaigns.

6. Where data is stored and how it is protected

• Primary database: Supabase, Singapore region. Hosting: Vercel.
• Each business's data is isolated by database row-level security; access is role-based; integration tokens are encrypted at rest (AES-256-GCM); traffic is encrypted in transit.

7. How long we keep it

Customer Data is kept while the workspace exists. When a business deletes its workspace, data is removed within 30 days and from backups on their normal cycle. Activity logs are kept for security for up to 12 months.

8. Your rights

You can ask to access, correct, export or delete your personal data, or object to its use. End customers should contact the business that holds their data; we will help that business respond. Account users can contact us through the Po app.

9. Changes

We will post any changes here with a new version date and tell account users about important changes.