Privacy Policy

This Privacy Policy explains how Creative Crew Studio ("we", "us", "our"), operating the HeyWoozy platform at heywoozy.com, collects, uses, stores, and protects information when you use our services. HeyWoozy is an AI receptionist platform that processes messages across WhatsApp, Facebook, Instagram, and phone calls on behalf of businesses.

By using HeyWoozy, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use our services.

1. Information We Collect

1.1 Account Information

When you create an account, we collect your name, email address, business name, phone number, and billing information. This is necessary to provide and manage your subscription.

1.2 Business Data

You provide business-specific information to configure your AI receptionist, including your knowledge base content, business hours, service descriptions, pricing, booking preferences, and team member details.

1.3 Message Content

HeyWoozy processes messages received through WhatsApp Business API, Facebook Messenger, Instagram Direct Messages, and phone calls on behalf of your business. This includes the content of conversations between your AI receptionist and your end users (the people contacting your business). Message content is processed to generate AI responses and stored to maintain conversation history.

1.4 End User Information

When end users contact your business through connected channels, we collect their name, phone number or social media identifier, and message content. This information is collected and processed on behalf of your business to facilitate communication and lead management.

1.5 Usage and Analytics Data

We collect information about how you interact with the HeyWoozy dashboard, including pages viewed, features used, conversation volumes, response times, and general usage patterns. We also collect device information, browser type, IP address, and similar technical data.

2. How We Use Your Data

We use the information we collect to:

• Provide and operate the HeyWoozy platform, including AI-powered message responses
• Process messages through our AI engine (powered by Google Gemini) to generate contextual responses on behalf of your business
• Store conversation history so you can review interactions with your customers
• Capture and manage leads from incoming conversations
• Handle booking and appointment scheduling
• Route conversations to your human team members when escalation is needed
• Process payments and manage your subscription
• Send service-related communications (account updates, billing, security alerts)
• Improve our platform, fix issues, and develop new features
• Provide customer support
• Comply with legal obligations

3. Third-Party Services

HeyWoozy integrates with the following third-party services to deliver our platform. Each service has its own privacy policy governing their handling of data:

• Supabase — Database hosting and authentication. Stores account data, business configuration, and conversation records.
• Google Gemini — AI language model. Processes message content to generate responses. Message content is sent to Google's API for processing but is not used by Google to train their models.
• Meta (WhatsApp Business API, Facebook, Instagram) — Messaging infrastructure. Delivers and receives messages through WhatsApp, Facebook Messenger, and Instagram Direct Messages.
• Twilio — Telephony infrastructure for phone call handling.
• ElevenLabs — Voice AI for natural-sounding phone call interactions.
• Stripe — Payment processing. Handles all billing and subscription payments securely. We do not store your full card details on our servers.
• Upstash — Message queuing infrastructure. Temporarily holds messages in transit for reliable processing.
• Vercel — Application hosting for our web dashboard.

4. Data Processing on Behalf of Businesses

When your business uses HeyWoozy to communicate with your customers through WhatsApp, Facebook, Instagram, or phone, we act as a data processor on your behalf. You (the business) remain the data controller for your end users' personal data. You are responsible for ensuring you have an appropriate legal basis for collecting and processing your end users' data, and for informing your end users about how their data is used.

Messages processed through Meta's platforms (WhatsApp, Facebook, Instagram) are subject to Meta's own data policies in addition to this privacy policy. By connecting your Meta Business accounts to HeyWoozy, you authorise us to send and receive messages through Meta's APIs on your behalf.

5. Data Retention

We retain your account data and business configuration for the duration of your active subscription. Conversation history is retained for the duration of your subscription to provide you with access to past interactions.

When you cancel your subscription, your data is retained for 30 days to allow for reactivation. After this period, your account data, business configuration, and conversation history are permanently deleted from our systems and backups within 90 days.

Temporary message queue data in Upstash is automatically purged after processing, typically within minutes.

6. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS/SSL), encryption at rest for stored data, role-based access controls, and regular security reviews. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

7. Your Rights

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the following rights:

• Right of access — You can request a copy of all personal data we hold about you.
• Right to rectification — You can request correction of inaccurate or incomplete data.
• Right to erasure — You can request deletion of your personal data, subject to legal retention requirements.
• Right to data portability — You can request an export of your data in a machine-readable format.
• Right to restrict processing — You can request that we limit how we use your data.
• Right to object — You can object to processing based on legitimate interests.

To exercise any of these rights, contact us at hello@woozysocial.com. We will respond to your request within 30 days.

8. Cookies

HeyWoozy uses essential cookies to maintain your session and keep you logged in. We may also use analytics cookies to understand how our dashboard and marketing site are used. We do not use advertising or tracking cookies.

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent parts of the platform from functioning correctly.

9. Children's Privacy

HeyWoozy is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly. If you believe we may have collected data from a child under 16, please contact us at hello@woozysocial.com.

10. International Data Transfers

Some of our third-party service providers process data outside the United Kingdom. Where data is transferred internationally, we ensure appropriate safeguards are in place, including standard contractual clauses and adequacy decisions, in compliance with UK data protection law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice on our platform. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of HeyWoozy after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: