Privacy policy

Who is responsible for your data

The data controller is Telloox. For anything about your data, write to [email protected].

What we collect

• Account: name, email address, password (stored only as a hash), the languages you speak, the language of the panel and your role in each workspace.
• Workspace: its name, the widget settings, the allowed domains, the canned replies and the domain where the widget last loaded.
• Activity: your availability, when you were last online, the conversations assigned to you and the messages you write.
• Devices: if you turn on notifications, the address your browser’s push service gives us and the browser’s description (user agent).
• Security: your IP address is used to limit repeated attempts, such as logins and sign-ups. We store only a hash of it, deleted within a day. The hosting provider’s web servers also record requests (IP address, page, browser) in technical logs.
• Statistics: daily counts of conversations and messages per workspace, without personal data.
• Support: what you write to us, by email or in the chat on this website, and your contact details.
• Payments, for paid plans only: Creem handles your billing details. We never see your card number; we receive from Creem only what we need to activate the plan: who bought it, which plan and the payment status.

Why we use it, and on what legal basis

• To provide the service, send service emails (verification, password reset, invitations), deliver the notifications you turn on and answer you: performance of a contract, art. 6(1)(b) GDPR.
• To keep the service secure, prevent abuse and understand how much it is used: our legitimate interest, art. 6(1)(f) GDPR.
• To meet tax and accounting duties on paid plans: legal obligation, art. 6(1)(c) GDPR.

What we do not do

We do not sell personal data, we do not use advertising or analytics trackers, and no decision with legal effects on you is taken automatically.

If you chatted with a website that uses Telloox

The owner of the website decides why and how the chat is used, and is the data controller of your chat data. We process it on their behalf, only to run the chat, as set out in our data processing agreement. To exercise your rights, write to the website: we help them answer you.

The widget handles your messages and attachments, your name and email address if you give them, data the website passes about you, your language, your browser, the page you are on, your approximate location (country and city) and the times of your visits. Your location is worked out from your IP address, which is not stored. This data is deleted after the period the website chose, 30 days unless it changed it, or earlier if the website deletes it.

Who receives your data

Members of your workspaces see your name, your email address, your availability and the messages you write. We also use these providers, each only for its purpose:

• DreamHost (United States): hosting of the site, the database and the attachments, and delivery of email.
• The push service of your browser’s maker (for example Google, Mozilla, Apple or Microsoft): delivery of notifications, only if you turn them on. The content of each notification is encrypted and the push service cannot read it.
• Creem (Estonia): payments for paid plans.

What stays on our servers

Country and city are worked out on our own server, with a copy of the DB-IP database: no data is sent to DB-IP. Fonts and scripts are served by Telloox itself, with no third-party CDN.

Transfers outside the European Union

Some of these providers are based in the United States. In those cases the transfer relies on an adequacy decision, where the provider is covered by one, or on the Standard Contractual Clauses of the European Commission. Write to us for details of these safeguards.

How long we keep it

• Account and workspace: for as long as they exist. A deleted workspace is removed at once, with all its data. When you ask us to delete your account, we do so within one month, except for what the law requires us to keep.
• Conversations, visitors and attachments: for the period each workspace chooses, between 1 and 3,650 days, 30 unless it is changed.
• Notification devices: until you turn notifications off or the browser withdraws them.
• Hashes used against repeated attempts: deleted within a day.
• Support requests: for as long as needed to handle them.
• Accounting records for paid plans: 10 years, as required by Italian law.

Your rights

You can ask us for access to your data, correction, deletion, restriction, a copy in a portable format, and you can object to processing based on our legitimate interest. Write to [email protected]: we reply within one month. You can change your name, email address, languages and password in your account at any time.

You also have the right to lodge a complaint with a supervisory authority: in Italy, the Garante per la protezione dei dati personali.

Other information

• Providing your name and email address is necessary to create an account; without them we cannot provide the service.
• The service is meant for businesses and professionals and is not intended for people under 18.
• For cookies and browser storage, see the cookie policy.
• If this policy changes substantially, we tell registered users by email.