Privacy Policy

Last updated June 15, 2026

Draft — pending legal review. This document is a working template provided for review and is not yet binding. Have it reviewed by counsel before relying on it.

This Privacy Policy explains how Envoy (“Envoy,” “we”) handles personal data in connection with the EnvoyEngage platform and its apps, including VendorApp (the “Service”). It covers personal data we process as a controller (e.g. about workspace admins and website visitors). Where we process personal data on behalf of a customer (e.g. their end users’ support data), we act as a processor under our Data Processing Agreement.

Information we collect

Account information — name, work email, company, and the workspace you create at signup.
Workspace and portal configuration — branding, organizations, and user records you create or sync.
Support content — tickets, organizations, and users synced from the Zendesk you connect, processed on your behalf.
Usage and log data — IP address, device/browser information, and actions taken, used to operate and secure the Service.
Cookies — see our Cookie Notice.

How we use personal data

To provide, secure, and improve the Service.
To authenticate users and enforce tenant isolation and access controls.
To send transactional email (e.g. sign-in, account, and request notifications).
To respond to enquiries and provide support.
To comply with legal obligations and enforce our terms.

Legal bases (EEA/UK)

Where applicable, we rely on performance of a contract, our legitimate interests in operating and securing the Service, your consent (where required), and compliance with legal obligations.

Sharing and sub-processors

We share personal data with service providers that help us run the Service, listed in our Sub-processors. We do not sell personal data. We may disclose data where required by law or to protect the Service.

International transfers

Personal data may be processed in countries other than your own. Where required, we use appropriate safeguards such as Standard Contractual Clauses.

Retention

We retain personal data for as long as needed to provide the Service and for legitimate business or legal purposes. Customer Data handling on termination is described in the DPA.

Security

We use technical and organizational measures to protect personal data, described on our Security & Trust page.

Your rights

Depending on your location, you may have rights to access, correct, delete, or port your personal data, and to object to or restrict certain processing. For data we process on a customer’s behalf, please contact that customer; we will assist them as described in the DPA. To exercise rights or ask questions, contact jakub@goenvoy.co.

Children

The Service is not directed to children and is intended for business use.

Changes and contact

We may update this Policy; material changes will be communicated through the Service or by email. Contact: jakub@goenvoy.co.