Legal

Privacy Policy

What we collect, why we collect it, and the control you keep over it.

Last updated October 2026

1. Introduction

Whizo AI ("we", "our", "us") respects your privacy. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data when you use our platform at whizo.ai.

2. Information We Collect

We collect information in the following ways:

  • Trial requests: Business email, full name, job title and the details you give about your agency in the trial form, and the time of any demo call you book
  • Account information: Name, email address, password (hashed), and billing details where fees apply
  • Usage data: Pages visited, features used, session duration, and click events
  • Content data: Posts, captions, images, videos, files, notes and other content you create or upload
  • Business data: CRM contacts and deals (including leads from Facebook Lead Ads), tasks, client requests, and conversations: emails and, when the phone system is on for your agency, text and WhatsApp messages, call logs, voicemail and, where your agency turns it on, call recordings
  • Integration data: OAuth tokens for connected accounts (Meta, Google, etc.)
  • Website visitor data: When an agency adds the Whizo tracking script to its own or a client's website, we process visits to that website on the agency's behalf: pages viewed, clicks and scrolling, referrer, device, approximate location from the IP address, and the link to a contact when a visitor is identified
  • Device data: IP address, browser type, operating system, and push notification tokens for the mobile and web apps

3. How We Use Your Information

We use collected data to:

  • Provide and improve the Whizo AI platform
  • Handle trial requests and demo calls, and billing where fees apply
  • Send transactional emails (invoices, password resets, notifications)
  • Send the emails, texts and WhatsApp messages you send through Whizo AI
  • Publish the posts you schedule and approve to Facebook and Instagram
  • Analyze usage patterns to improve features
  • Comply with legal obligations
  • Provide customer support

4. AI Features and Data Processing

When you use AI-powered features (Ask Whizo, the AI agents switched on for your agency, content generation, lead summaries and reply drafts), your messages are processed by a third-party AI provider: Anthropic (Claude) or OpenAI, or another provider with an OpenAI-compatible service such as Google (Gemini). When Ask Whizo searches the web for you, only the search query is sent to our web search provider (Serper).

Some AI features (for example, Ask Whizo and the AI agents) can look up and include relevant workspace data in the request sent to the provider — such as CRM leads, conversations, tasks, notebook pages you can see, or client/workspace records — in addition to the text you type, in order to answer your question accurately. We only send the data needed to fulfill your specific request. Call and meeting recordings are transcribed on our own servers; the transcript may then be sent to an AI provider to write the notes.

We do not sell your content, and we do not permit these providers to use your data to train their general-purpose models. Content is processed solely to generate the response you requested.

5. Google User Data

You can sign in to Whizo AI with Google, and each team member can connect their own Google Calendar. This section explains exactly what we access from your Google account and what we do with it.

What we access. With Google sign-in we receive your name, email address and profile picture (the openid, email and profile scopes), only to sign you in and show who you are in the app. When you connect Google Calendar we ask for two more permissions: calendar.readonly, to read your calendars and their events, and calendar.events, to create, update and cancel the events you schedule in Whizo AI.

How we use it. We use calendar data only to provide features you can see and use: showing your schedule and busy times next to your work, finding free times so a meeting with a lead or client is not double-booked, creating the meetings you schedule in Whizo AI on your own calendar (with a Google Meet link when you choose one), and recording your replies to invitations. If you ask Whizo chat about your calendar, the relevant events are sent to the AI provider handling that request, only to answer it (see Section 4).

What we store. We keep a copy of your events from one week back to 60 days ahead so your calendar loads quickly and stays in sync, plus the names of the calendars you choose to show. Google access and refresh tokens are encrypted at the application level and never leave our servers.

Sharing. We do not sell Google user data, use it for advertising, or use it to train or improve AI or machine-learning models, ours or anyone else's. We do not let people read it, except with your permission, to investigate a security issue, or to comply with the law. Your event details are visible only to you inside Whizo AI. Teammates who schedule a meeting with you see only when you are busy (times, no titles or details), and clients see none of it.

Your control. You can disconnect Google Calendar at any time in Whizo AI. When you disconnect, we delete the stored events and tokens. You can also remove our access at myaccount.google.com/permissions.

Whizo AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Data Sharing

We do not sell your personal data. We share data only with:

  • Service providers: Amazon Web Services (database, hosting and file storage), Mailgun (email), Twilio (texts, calls and WhatsApp messages, when the phone system is on for your agency), Apple and Google Firebase (push notifications), Sentry (error monitoring), Cloudflare Turnstile (spam protection on our forms), Serper (web search queries), and PostHog, Microsoft Clarity and Google Analytics (website and product analytics)
  • AI providers: Anthropic and OpenAI, or another OpenAI-compatible provider such as Google — only when you use an AI-powered feature, and only with the message and/or workspace data needed to generate that response (see Section 4)
  • Connected platforms: Meta (Facebook, Instagram, Lead Ads and ad accounts), Google and Apple — only with your explicit authorization, including publishing the posts you approve to Facebook and Instagram
  • Legal authorities: When required by law or to protect our rights

7. Data Security

We implement industry-standard security measures including encryption at rest and in transit, row-level security (RLS) policies, and regular security audits. Passwords are hashed using argon2id, and two-step verification with an authenticator app is available. Tokens for connected accounts (social, calendar, email and ad accounts) are encrypted at the application level.

8. Cookies

We use cookies and similar technologies for authentication, preferences, and analytics. You can manage cookie preferences through your browser settings or our cookie consent banner. Essential cookies required for platform functionality cannot be disabled.

9. Data Retention

We retain your data for as long as your account is active. Upon account deletion, your data is removed within 30 days, except where required by law. Items you delete wait in the recycle bin for 30 days before they are removed for good. The audio of call and meeting recordings is deleted 30 days after the recording; the transcript and notes stay until you delete them. Analytics data may be retained in anonymized form.

10. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Request a copy of your data in a portable format
  • Opt out of marketing communications

To exercise these rights, contact us at privacy@whizo.ai.

11. Children's Privacy

Whizo AI is not intended for users under 16 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you via email or in-app notice before significant changes take effect. The date at the top of this page reflects the latest update.

13. Contact Us

For privacy-related questions or requests, contact: privacy@whizo.ai or visit our support page.