Privacy Policy

This Privacy Policy explains how Envoy Studios, Inc. (“Envoy,” “we”) handles personal data in connection with the EnvoyEngage platform and its apps, including VendorApp (the “Service”). It covers personal data we process as a controller (e.g. about workspace admins and website visitors). Where we process personal data on behalf of a customer (e.g. their end users’ support data), we act as a processor under our Data Processing Agreement.

Information we collect

• Account information — name, work email, company, and the workspace you create at signup.
• Workspace and portal configuration — branding, organizations, and user records you create or sync.
• Support content — tickets, organizations, and users synced from the Zendesk you connect, processed on your behalf.
• Connected system identifiers — when you connect a system such as Jira, we store the identifier of the account that authorized the connection, and any account identifiers used in the routing you configure. We store the identifier itself, not the person’s name or address.
• Mobile messaging data — if you message our RCS sender, your mobile number and the content of that conversation. See Mobile messaging data below.
• Usage and log data — IP address, device/browser information, and actions taken, used to operate and secure the Service.
• Cookies — see our Cookie Notice.

Mobile messaging data

When you start a conversation with Envoy’s RCS sender, we receive your mobile number, the messages you send, and delivery information from your carrier. We use it to answer you and to keep a record of the conversation for support, and for nothing else.

Mobile information, including your phone number and the fact that you opted in, is never shared with third parties or affiliates for marketing or promotional purposes. No mobile opt-in data is sold, rented, or passed on for anyone else’s marketing. It is shared only with the service providers that carry the message to you, listed in our Sub-processors, and where the law requires it.

Reply STOP at any time to end messaging. The terms of the program are in our RCS Messaging Terms.

How we use personal data

• To provide, secure, and improve the Service.
• To authenticate users and enforce tenant isolation and access controls.
• To send transactional email (e.g. sign-in, account, and request notifications).
• To respond to enquiries and provide support.
• To comply with legal obligations and enforce our terms.

Legal bases (EEA/UK)

Where applicable, we rely on performance of a contract, our legitimate interests in operating and securing the Service, your consent (where required), and compliance with legal obligations.

Sharing and sub-processors

We share personal data with service providers that help us run the Service, listed in our Sub-processors. We do not sell personal data. We may disclose data where required by law or to protect the Service.

The systems you connect are not sub-processors. Your Zendesk, Salesforce and Jira are your own, described under Your own systems.

One disclosure runs the other way and is worth stating plainly. Where you connect a Jira site, Atlassian requires any application holding Atlassian account identifiers to report them back on a recurring cycle, so Atlassian can tell us when someone has closed their account and we can erase our copy. We send the account identifier and the date we last confirmed we still hold it. No names, addresses, or ticket content are included.

International transfers

Personal data may be processed in countries other than your own. Where required, we use appropriate safeguards such as Standard Contractual Clauses.

Retention

We retain personal data for as long as needed to provide the Service and for legitimate business or legal purposes. Customer Data handling on termination is described in the DPA.

Security

We use technical and organizational measures to protect personal data, described on our Security & Trust page.

Your rights

Depending on your location, you may have rights to access, correct, delete, or port your personal data, and to object to or restrict certain processing. For data we process on a customer’s behalf, please contact that customer; we will assist them as described in the DPA. To exercise rights or ask questions, contact jakub@goenvoy.co.

Children

The Service is not directed to children and is intended for business use.

Changes and contact

We may update this Policy; material changes will be communicated through the Service or by email. Contact: jakub@goenvoy.co.