Privacy Policy

1. Who we are and what this policy covers

[To be completed: Legal name of the company] (“Galdrik”, “we”) runs the Galdrik service and website. This policy covers three groups of people:

• people who use Galdrik for their business (owners, admins and agents of a workspace);
• people who visit our website;
• the customers of those businesses, whose conversations pass through Galdrik.

For the account and billing data of the businesses we serve, we decide how the data is used. For the conversations between a business and its customers, the business decides and we process the data on its behalf. If you are a customer of a business that uses Galdrik, contact that business first; we help it answer your request.

2. The data we handle

Account and workspace data:

• name, work e-mail, business name and country you give us when you sign up or accept an invitation;
• your password, stored only as a one-way hash; your two-step verification secret, stored encrypted;
• sign-in records: when you signed in, a short description of your browser or device, and your IP address;
• your role, preferences and settings.

Billing data:

• the owner's e-mail and the business name, which we send to Stripe to create the customer record;
• the identifiers, plan, amounts and status of your subscription. Card details are entered on Stripe's own page; we never receive or store them. When sales tax applies, Stripe also collects a billing address and, optionally, a tax ID.

Conversation data, which we process for the business:

• your customers' WhatsApp phone numbers and profile names;
• the messages and files exchanged, including chat history that WhatsApp shares when a business connects a number it already uses in the WhatsApp Business app;
• internal notes, customer ratings, conversation summaries and details the AI notes from the conversation (for example an order number), and the cases handed to your team;
• the knowledge your business adds (FAQs, instructions, saved replies).

Records of the AI's work:

• for each AI reply we keep what was sent to the AI provider and what it answered, the tools it used and why it handed a conversation to a person, so the business and our support team can check what the AI did.

Website visitors:

• we do not use analytics or advertising trackers and our website sets no cookies. See cookies and browser storage.

3. How we use it

• to run Galdrik: receive and send WhatsApp messages, write AI replies, hand conversations to your team, send the e-mails you need (sign-in, invitations, alerts, billing notices);
• to bill your subscription;
• to keep the service secure and prevent abuse;
• to give support. When our staff need to look inside a workspace to help, they open a time-limited support session with a stated reason, every access is logged, and anything they change is marked as done by support;
• to meet legal obligations.

We do not sell personal data, we do not use it for advertising, and we do not train AI models with it.

4. The AI assistant

To write a reply, Galdrik sends the AI provider the recent messages of the conversation, its summary and noted details, and the business's knowledge and instructions. The request carries an internal workspace identifier, not the business's name. The provider in use is chosen by us and listed, with where it processes data, on our subprocessors page.

Providers process these requests under their own API terms. For example, Fireworks AI publishes that, by default, it does not store prompts or replies for open models: they are kept only in memory while the request runs (a few minutes when prompt caching is used) and only metadata such as usage counts is logged.

Demos. If you open a demo that a member of our team prepared for your business, the questions you type in it are kept for 30 days so the team that shared the demo can read them, and are then deleted. They are processed by the AI provider that writes the demo's answers, listed on our subprocessors page. Please do not type sensitive personal data in a demo.

5. Who we share it with

• Companies that process data for us (hosting, network protection and backups, payments, e-mail, the WhatsApp connection and AI). They are listed on our subprocessors page with what each one does and where.
• E-mail alerts about cases handed to your team contain a short AI summary and the customer's name or number.
• Tools a business turns on: for example an address lookup sends the address to the tool's provider, and a custom tool a business sets up sends data to the address the business chose.
• Authorities, when the law requires it.
• A buyer or successor, if our business is merged or sold, under this policy.

6. Where data is stored and processed

• Our application and database run in a data center in Helsinki, Finland (European Union).
• Encrypted database backups are stored with Cloudflare in the European Union.
• WhatsApp messages pass through the servers of our WhatsApp connection provider, which states they are in Malaysia.
• AI requests are processed where the active AI provider operates; today that is the United States, or China if a China-based provider is active (see the subprocessors page).
• E-mail and payments are processed in the United States.

This means your data can be transferred outside the country where you live.

7. How long we keep it

While a workspace exists:

• account data, conversations, files, notes, AI records and knowledge are kept while the workspace exists. We do not delete them automatically today; the owner can ask us to delete the whole workspace.

Short-lived technical data:

• delivery notices from the WhatsApp connection: deleted 7 days after they are processed (30 days if they were not recognised);
• logs of those notices: deleted after 90 days; notices held back for ordering: deleted after 3 hours;
• sign-in sessions expire after 7 days and expired ones are removed at the next sign-in; password reset links last 1 hour, e-mail verification links 24 hours and invitations 7 days.

When a workspace is deleted:

• the owner asks us; we schedule the deletion with a waiting period (7 days unless agreed otherwise) during which it can be cancelled. A workspace with an active paid subscription is cancelled first;
• then everything that belongs to the workspace is deleted from our live database: users and their sign-in sessions, conversations, contacts, files, notes, AI records, knowledge and settings;
• we keep, without a fixed end date, the records that show what happened: support access and support sessions, changes to the workspace's status, plan and settings (who changed what), and the deletion request itself. They are kept for security, accounting and legal reasons;
• encrypted backups still hold a copy for up to 90 days (weekly backups are kept 90 days, nightly ones 14 days) and are then replaced;
• Stripe keeps payment records under its own legal obligations.

8. How we protect it

• Traffic is encrypted in transit; our servers only accept connections from our network protection provider.
• Each business's data is separated in the database by row-level rules, so one workspace cannot read another's.
• Passwords are stored as one-way hashes; two-step verification is available; connection keys and secrets are encrypted.
• Backups are encrypted. Sign-in and other sensitive actions are rate-limited.
• Staff access to a workspace needs a time-limited, logged support session.

No system is perfectly secure. If a breach affects your data we will tell you as the law requires.

9. Your choices and rights

• You can see and correct your name and settings in your profile.
• To get a copy of a workspace's data or to delete it, the owner writes to [To be completed: E-mail for privacy requests]. Conversations can also be downloaded as text files from the workspace.
• Depending on where you live (for example California, other U.S. states or Canada), you may have the right to know what we hold about you, get a copy, correct it, delete it, and not be treated differently for asking. We do not sell or share personal data for advertising.
• We confirm who you are before acting on a request and answer within the time the law requires.
• Customers of a business that uses Galdrik should contact that business; we help it answer.

10. Cookies and browser storage

Galdrik sets no cookies and uses no analytics or advertising tools. In your browser it stores only:

• your sign-in session and basic user details, so you stay signed in (until you sign out or it expires);
• your light or dark theme choice;
• small notes for the current browser session: which banners you closed, and when the page last reloaded itself after an update (to avoid reloading twice).

11. Children

Galdrik is a service for businesses and is not meant for anyone under 18 to sign up. We do not knowingly collect children's data for our own purposes; businesses decide who they talk to.

12. Changes

When this policy changes we update the date at the top of the page, and we tell workspace owners before a material change takes effect.

13. Contact

• Privacy requests: [To be completed: E-mail for privacy requests]
• Company: [To be completed: Legal name of the company], [To be completed: Registered address]