Privacy Notice

Who we are

Truplexy is operated by Zenova Agency, based in Gazipur, Bangladesh (“we”, “us”). This notice covers this website (https://truplexy.com), the dashboard (https://app.truplexy.com), the API and the chat widget. Our role depends on whose data it is:

• Our customers’ account data. Information about the people who sign up and run Truplexy for their business (their sign-in details, team members, billing). For this, we decide why and how it is used: we are the controller.
• Our customers’ customer data. The messages and details of the people who chat with a business through Truplexy. The business decides why this is collected and what it is used for; we process it on the business’s behalf: we are the processor. If you are such a person and want to see, correct or delete your data, ask the business you contacted first. We will help them respond. Their privacy notice applies to you as well.

What we collect

Account and team data

• Your email address, name and password (stored hashed by our sign-in provider), or the name, email and profile picture from Google if you use Google sign-in.
• Your role in a business, invitations you send or accept, a profile picture or business logo you upload, and a record of important actions in the dashboard (an audit log).
• Billing details such as plan, balance and purchase history. Payment-card details go to Paddle; we do not receive or store them.
• Messages you send us, such as support requests.

Customer data, which businesses put through Truplexy

• A customer’s name and contact details: email, phone number, and handles on messaging platforms such as WhatsApp, Telegram, Discord or Slack, as supplied by the business or its customers.
• Conversations: what the customer wrote, what the assistant and team replied, tickets, notes, AI summaries, and the channel each message came from.
• Optional extra fields (“metadata”) the business chooses to attach to a customer.
• Dates when a customer was first and last seen, and counts of their conversations and tickets.

Customers can type anything into a conversation. Businesses should tell them not to share passwords, payment-card numbers or other sensitive information, and our terms say the service is not for processing that kind of data.

Knowledge base and settings

Files and articles a business uploads so the assistant can answer from them, and the passages and search embeddings we derive from them, plus the business’s assistant and channel settings. Connected platforms such as Meta or Shopify give us access tokens; these are stored encrypted and removed when you disconnect.

Usage and technical data

Token counts, estimated cost, request logs, error logs and IP address and device information that our hosting and security tooling record when the service is used. We use these to run, bill for and protect the service.

How we use it

• To provide the service: create and secure accounts, run conversations across channels, keep one thread per customer, hand off to a person, show usage and balances.
• To take payment and keep records through Paddle, and to meet tax and accounting duties.
• To keep the service safe: detect abuse, fraud and security incidents, enforce our terms and limits.
• To support you and send service messages: sign-in links, invitations, security and billing notices, and changes to our terms.
• To improve Truplexy, using aggregated and de-identified statistics, and error and performance logs. We do not use customer data to advertise to anyone, and we do not sell personal data.

Where the law requires a legal basis, ours are: performing our contract with you, our legitimate interests in running, securing and improving the service, legal obligations, and consent where we ask for it (you can withdraw it any time). For customer data we act only on the business’s instructions.

AI processing

Truplexy uses AI language models to write replies. Plainly:

• What is sent. To answer a customer, we send the relevant part of the conversation and the passages from the business’s knowledge base needed to answer it to a model provider, through OpenRouter. We do not send the business’s unrelated data.
• Who processes it. The model providers behind OpenRouter act as our sub-processors. Which model is used depends on the business’s settings, so the provider can differ. Each provider’s own terms govern how long it keeps requests.
• Embeddings. Knowledge-base text is turned into numeric vectors for search using Cloudflare Workers AI, and stored in Cloudflare.
• Automated replies. Replies are produced automatically and can be wrong. A business can set when a person takes over, and its team can read and correct any conversation. We do not make legal or similarly significant decisions about people using these replies.
• Training. Zenova Agency does not train or fine-tune AI models on your content or your customers’ conversations. Model providers are independent companies: how they handle requests sent to them, including whether they keep them or use them for training, is set by their own terms and policies, which we cannot change. If this matters for your business, tell us before you connect sensitive data and keep it out of your knowledge base and conversations.

Who we share it with

We do not sell personal data. We share it with the service providers below who help us run Truplexy, only as far as they need to, and under contracts that restrict their use of it:

We also exchange messages with the platforms a business connects (for example WhatsApp, Messenger, Instagram, Telegram, Discord, Slack, Microsoft Teams, Shopify, HubSpot, Zendesk and WordPress). That is how a customer’s message reaches Truplexy and how replies go back. Those platforms are independent and have their own privacy notices.

We may disclose data if the law requires it, to protect rights, safety or security, or in a merger, acquisition or sale of the business (we will tell you and your choices will be respected). We may share a business’s data with people it authorises, such as team members and invited users.

The chat widget

When a business puts the website chat widget on its site, the visitor may be asked for a name and email before the first message. Those details and a signed session token are kept in the browser’s local storage on that site, so the conversation continues on the next visit; the widget does not set cookies. Clearing the browser’s site data removes them. Messages and the details given are processed for the business as described above. The widget script is served from jsDelivr.

This website

This marketing site (https://truplexy.com) does not use advertising or analytics cookies, tracking pixels or third-party analytics, and has no cookie banner. Our hosting provider keeps standard server logs (IP address, browser, requested page) for security and reliability. If you email us, we keep the message and your address to reply.

How long we keep it

• Conversation history is kept for the period of the business’s plan: 7 days on the no-charge tier, 90 days on Starter and 1 year on Pro.
• Account data is kept while the account is open. When a user deletes their account, we anonymise it: the email is replaced and the name removed.
• Deleted businesses can be restored for 30 days. After that, all of their records, knowledge-base files and search vectors are permanently erased.
• Customers a business deletes are removed from its customer list. Past conversations and tickets are kept for the plan’s history period.
• Billing and tax records are kept as long as the law requires, typically several years.
• Backups and logs expire on a rolling schedule after deletion.

Security

We protect data with measures such as encrypted connections (HTTPS), encrypted storage of platform access tokens, role-based access inside each business, separation between businesses, and limited access for our own staff. No system is perfectly secure. If a breach affects your data we will tell you as the law requires.

International transfers

Our providers operate in several countries, so data may be processed outside the country where you live, including in the United States. Where the law requires, we rely on safeguards such as standard contractual clauses or an adequacy decision. Ask us if you want to know more about the safeguards used.

Your rights

Depending on where you live, you may have the right to know what we hold about you, to get a copy, to have it corrected or deleted, to restrict or object to some uses, to receive it in a portable format, to withdraw consent, and to complain to your data-protection authority. To use a right regarding account data, email hello@truplexy.com. We will respond within the time the law sets, after checking it is you. Rights regarding customer data are normally exercised through the business you chatted with.

You can also delete knowledge-base files, customers and tickets in the dashboard, and change or close your account there. We do not make decisions about you based solely on automated processing that significantly affect you.

Children

Truplexy is for businesses and not meant for anyone under 18. We do not knowingly collect their data for our own purposes. If you think a child has given us data, contact us and we will delete it. A business that runs a chat for children is responsible for doing so lawfully.

Changes

We will update this page when our practices change, and revise the date at the top. For material changes we will email account owners or show a notice in the dashboard before they take effect.

Contact

Zenova Agency
zenova.agency
Gazipur, Bangladesh
hello@truplexy.com

See also: Terms of Service · Refund Policy