Privacy Policy

Version 1 · 24 October 2026

Draft: awaiting legal review.

Papodee is a customer-support inbox made by Busyworks Unipessoal Lda. (NIF PT515062650), Rua Castilho 32, 4.º, 1250-070 Lisboa, Portugal ("Busyworks", "we"). This policy explains what personal data Papodee handles, why, and your rights. Questions: use our contact form (choose "Privacy or data request") or write to us at the address above.

1. Two kinds of data, two roles

Your account data. When a business ("company") uses Papodee, the people who sign in (admins and agents) give us their name, email address, password (stored only as a secure hash), picture if they add one, phone number if they turn on WhatsApp alerts, and settings. For this data Busyworks is the controller.

Conversation data. Papodee also holds the messages that a company's customers send through WhatsApp, email or the website chat, together with their name, phone number or email address, attachments, notes the company's team writes, and the company's knowledge (documents, web pages and facts). The company decides why and how this data is used and is its controller; Busyworks processes it on the company's behalf, under the Terms of Service (which include the data processing terms of GDPR Article 28). If you wrote to a business that uses Papodee, please contact that business first about your data; we will help them answer you.

2. What we use the data for

• To run the service: receive and send messages, show conversations to the company's team, alert agents, and let the AI assistant answer from the company's knowledge (contract; for conversation data, on the company's instructions).
• To bill AI use and process top-ups (contract and legal obligations, including tax).
• To keep the service secure, prevent abuse and fix problems (legitimate interest).
• To email account holders about the service: invitations, password resets, low-credit warnings (contract).

We do not sell personal data, use it for advertising, or use conversation data to train AI models. We don't use advertising or tracking cookies; the app keeps you signed in with your browser's local storage.

3. AI answers

When a company switches on the AI assistant, the text of a conversation (and pictures the customer sent) is sent to the AI provider the company chose, to write a reply. The providers process this data for us under their business terms and do not use it to train their models. AI answers can be wrong; companies can switch the AI off, limit it, and hand any conversation to a person.

4. Who else processes the data

Transfers outside the EU are covered by the EU–US Data Privacy Framework where the provider is certified, and otherwise by the European Commission's Standard Contractual Clauses. We tell companies before we add a new provider of this kind.

5. How long we keep data

• Conversation data: as long as the company keeps it in Papodee. A company can ask us at any time to delete conversations or contacts; when a company closes its account, its data is deleted within 90 days (backups within a further 30 days).
• Account data: while you are a member of a company in Papodee, then deleted within 90 days.
• Billing records: as long as Portuguese tax law requires (currently 10 years).
• Security logs: up to 90 days.

6. Security

Data is encrypted in transit and at rest. Each company's data is kept apart by rules in the database itself, so one company can never see another's. WhatsApp access tokens and other secrets are kept in encrypted secret stores, never in ordinary tables.

7. Your rights

You can ask to see, correct, delete or receive a copy of your personal data, object to or restrict its use, and withdraw consent where we rely on it. For account data, use the contact form or write to us at the address above. For conversation data, ask the business you wrote to; we will help them. You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD).

8. Requests from authorities

We only disclose personal data to public authorities when the law requires it, after checking that the request is lawful, and only the minimum needed. Where allowed, we tell the company concerned first.

9. Changes

If we change this policy in a way that matters, we will tell companies by email and in Papodee before the change applies. The version and date are at the top.